CVE-2026-95818
published 2026-09-22CVE-2026-95818: A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt…
PriorityP417low3.6CVSS 3.1
AVLACHPRLUINSUCLILAN
EPSS
0.13%
2.3th percentile
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.
When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| the_gnu_c_library | glibc | >= 2.14 < 2.45 | 2.45 |
CVSS provenance
nvdv3.13.6LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat3.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU glibc up to 2.44 Dynamic Loader ld.so ORIGIN buffer overflow (WID-SEC-2026-3522)
vuldb·2026-10-14·CVSS 3.6
CVE-2026-95818 [LOW] GNU glibc up to 2.44 Dynamic Loader ld.so ORIGIN buffer overflow (WID-SEC-2026-3522)
A vulnerability classified as problematic has been found in GNU glibc up to 2.44. This issue affects some unknown processing of the file ld.so of the component Dynamic Loader. The manipulation of the argument ORIGIN leads to buffer overflow.
This vulnerability is listed as CVE-2026-95818. The attack must be carried out locally. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE)
ghsa_unreviewed·2026-09-22
CVE-2026-95818 [LOW] CWE-121 A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE)
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.
When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Red Hat
glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
vendor_redhat·2026-09-22·CVSS 3.6
CVE-2026-95818 [LOW] CWE-120 glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory.
Package: openshift/ose-rhel-coreos-8 (Red Hat OpenShift Container Platform 4) - Fix deferred
Package: openshift/ose-rhel-coreos-9 (Red Hat OpenShift Container Platform 4) - Fix deferred
No detection rules found.
No public exploits indexed.
2026-09-22
Published