CVE-2026-95818

Name of the Vulnerable Software and Affected Versions glibc versions 2.14 through 2.44

Description A stack-based buffer overflow exists in the dynamic loader (ld.so) of the GNU C Library. This issue occurs when a setuid/setgid (AT SECURE) program has a DT RPATH or DT RUNPATH that starts with $ORIGIN and is immediately followed by a NUL character or a forward slash '/'. In these cases, the loader reads and writes beyond the boundaries of its internal stack-allocated buffer. A local attacker can exploit this to cause a loader crash, resulting in a denial of service, or achieve limited disclosure of process memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.