CVE-2026-95818
Awaiting Analysis Awaiting Analysis - Queue

Stack-Based Buffer Overflow in GNU C Library (glibc)

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GNU C Library

Description
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-10-12
AI Q&A
2026-09-22
EPSS Evaluated
2026-10-11
NVD
CVE-2026-95818
EUVD
EUVD-2026-84558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu glibc From 2.14 (inc) to 2.44 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in the GNU C Library's dynamic loader (ld.so) affecting versions 2.14 through 2.44. It occurs when setuid/setgid programs have DT_RPATH or DT_RUNPATH starting with $ORIGIN followed by NUL or '/'. The loader reads and writes past buffer limits, causing crashes or memory corruption.

Detection Guidance

This vulnerability affects glibc versions 2.14 through 2.44 and is triggered by specific DT_RPATH or DT_RUNPATH configurations in setuid/setgid programs. Detection requires checking glibc version and inspecting binary paths for vulnerable configurations. No direct commands are provided in the context.

Impact Analysis

A local attacker could exploit this to crash setuid/setgid programs or disclose limited process memory. This may lead to denial of service or unauthorized information exposure on affected systems.

Compliance Impact

This vulnerability primarily impacts local system integrity and memory safety, which could indirectly affect compliance by compromising data confidentiality or system availability. However, the provided CVE details do not explicitly link this issue to specific compliance standards like GDPR or HIPAA.

Mitigation Strategies

Update glibc to a version outside the vulnerable range (2.14-2.44). Avoid using $ORIGIN in DT_RPATH or DT_RUNPATH for setuid/setgid programs. Monitor for crashes in setuid/setgid programs as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart