CVE-2026-95818
Received Received - Intake

Stack-Based Buffer Overflow in GNU C Library (glibc)

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GNU C Library

Description
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95818
EUVD
EUVD-2026-84558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu glibc From 2.14 (inc) to 2.44 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in the GNU C Library's dynamic loader (ld.so) affecting versions 2.14 through 2.44. It occurs when setuid/setgid programs have DT_RPATH or DT_RUNPATH starting with $ORIGIN followed by NUL or '/'. The loader reads and writes past buffer limits, causing crashes or memory corruption.

Detection Guidance

This vulnerability affects glibc versions 2.14 through 2.44 and is triggered by specific DT_RPATH or DT_RUNPATH configurations in setuid/setgid programs. Detection requires checking glibc version and inspecting binary paths for vulnerable configurations. No direct commands are provided in the context.

Impact Analysis

A local attacker could exploit this to crash setuid/setgid programs or disclose limited process memory. This may lead to denial of service or unauthorized information exposure on affected systems.

Mitigation Strategies

Update glibc to a version outside the vulnerable range (2.14-2.44). Avoid using $ORIGIN in DT_RPATH or DT_RUNPATH for setuid/setgid programs. Monitor for crashes in setuid/setgid programs as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart