Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-95818: glibc loader can crash privileged programs

CVE-2026-95818 · published 27 days ago

Summary

The GNU C Library (glibc) loader has a flaw that can be triggered when certain programs use a special path setting starting with $ORIGIN. This can cause the program to stop working or expose some of its memory, affecting programs that run with elevated privileges. Updating glibc to a patched version or applying the vendor's recommended fix will resolve the issue.

What to do

Update debian glibc to version 2.43-7.
Update the gnu c library glibc to version 2.45 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	the gnu c library	glibc	< 2.45
Debian:12	debian	glibc	All versions
Ubuntu:Pro:14.04:LTS	canonical	eglibc	All versions
Ubuntu:Pro:16.04:LTS	canonical	glibc	All versions
Debian:14	debian	glibc	< 2.43-7 Fix: upgrade to 2.43-7

Original advisory text

AT_SECURE program buffer overflow via $ORIGIN processing

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34360
https://ubuntu.com/security/CVE-2026-95818 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-95818 Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0023 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-95818 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95818... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-95818 Vendor Advisory
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-...

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.6 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-121Stack-based Buffer Overflow

Timeline

Published22 Sep 2026

Updated11 Oct 2026

First seen22 Sep 2026

Sources

CVE-2026-95818 · NVD

CVE-2026-95818 · MITRE

DEBIAN-CVE-2026-95818 · OSV

CVE-2026-95818 · OSV

UBUNTU-CVE-2026-95818 · OSV

Track software like this

Free during beta