Buffer Overflow Vulnerability in GNU C Library Affects Setuid/Setgid Programs
CVE-2026-95818

3.6LOW

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
22 September 2026

What is CVE-2026-95818?

A stack-based buffer overflow vulnerability in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 to 2.44 permits local attackers to manipulate memory associated with setuid/setgid programs. This issue arises when the program's DT_RPATH or DT_RUNPATH contains the $ORIGIN directive followed by a NUL character or '/' character. This situation allows the loader to read beyond the allocated buffer and overwrites the stack memory, potentially leading to crashes, memory corruption, or unauthorized disclosure of process memory.

Affected Version(s)

glibc 2.14 < 2.45

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34360
issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=ad...
vendor-advisory

CVSS V3.1

Score:
3.6
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AISLE in partnership with Red Hat
.