https://vulnogram.org/ Most recent CVEs assigned by GNU C Library (glibc). https://vulnogram.org/seaview/icons/glibc.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-97399 https://vulnogram.org/CVE-2026-97399 The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strin… Low Network Exploitable Mon, 28 Sep 2026 15:21:02 GMT https://vulnogram.org/CVE-2026-95818 https://vulnogram.org/CVE-2026-95818 A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUN… Low Tue, 22 Sep 2026 16:50:07 GMT https://vulnogram.org/CVE-2026-86805 https://vulnogram.org/CVE-2026-86805 A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECU… Medium Tue, 22 Sep 2026 15:55:17 GMT https://vulnogram.org/CVE-2026-8674 https://vulnogram.org/CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure w… Medium Thu, 17 Sep 2026 16:54:27 GMT https://vulnogram.org/CVE-2026-80489 https://vulnogram.org/CVE-2026-80489 Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC… Medium Network Exploitable Tue, 15 Sep 2026 10:51:59 GMT https://vulnogram.org/CVE-2026-77117 https://vulnogram.org/CVE-2026-77117 Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some S… Medium Network Exploitable Tue, 15 Sep 2026 10:48:56 GMT https://vulnogram.org/CVE-2026-19542 https://vulnogram.org/CVE-2026-19542 Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of… Medium Network Exploitable Mon, 14 Sep 2026 17:18:09 GMT https://vulnogram.org/CVE-2026-19499 https://vulnogram.org/CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmo… High Network Exploitable Mon, 14 Sep 2026 17:11:12 GMT https://vulnogram.org/CVE-2026-89092 https://vulnogram.org/CVE-2026-89092 The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a syst… Medium Fri, 11 Sep 2026 01:23:01 GMT https://vulnogram.org/CVE-2026-18374 https://vulnogram.org/CVE-2026-18374 Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker… Medium Thu, 27 Aug 2026 19:20:40 GMT https://vulnogram.org/CVE-2026-6791 https://vulnogram.org/CVE-2026-6791 When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using… Medium Network Exploitable Mon, 10 Aug 2026 18:41:25 GMT https://vulnogram.org/CVE-2026-6368 https://vulnogram.org/CVE-2026-6368 Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. Low Mon, 10 Aug 2026 18:40:11 GMT https://vulnogram.org/CVE-2026-6238 https://vulnogram.org/CVE-2026-6238 The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which… Medium Network Exploitable Tue, 28 Apr 2026 16:43:08 GMT https://vulnogram.org/CVE-2026-5435 https://vulnogram.org/CVE-2026-5435 The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. High Network Exploitable Tue, 28 Apr 2026 11:58:54 GMT https://vulnogram.org/CVE-2026-5450 https://vulnogram.org/CVE-2026-5450 Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow. Critical Network Exploitable Mon, 20 Apr 2026 20:55:41 GMT https://vulnogram.org/CVE-2026-5928 https://vulnogram.org/CVE-2026-5928 Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read… High Network Exploitable Mon, 20 Apr 2026 20:37:31 GMT https://vulnogram.org/CVE-2026-4046 https://vulnogram.org/CVE-2026-4046 The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be… High Network Exploitable Mon, 30 Mar 2026 17:16:11 GMT https://vulnogram.org/CVE-2026-4438 https://vulnogram.org/CVE-2026-4438 Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of t… Medium Fri, 20 Mar 2026 19:59:06 GMT https://vulnogram.org/CVE-2026-4437 https://vulnogram.org/CVE-2026-4437 Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation o… High Network Exploitable Fri, 20 Mar 2026 19:59:00 GMT https://vulnogram.org/CVE-2026-3904 https://vulnogram.org/CVE-2026-3904 Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other proces… Medium Wed, 11 Mar 2026 13:19:09 GMT https://vulnogram.org/CVE-2025-15281 https://vulnogram.org/CVE-2025-15281 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the proces… High Network Exploitable Tue, 20 Jan 2026 13:22:46 GMT https://vulnogram.org/CVE-2026-0915 https://vulnogram.org/CVE-2026-0915 Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configu… High Network Exploitable Thu, 15 Jan 2026 22:08:41 GMT https://vulnogram.org/CVE-2026-0861 https://vulnogram.org/CVE-2026-0861 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that t… High Wed, 14 Jan 2026 21:01:11 GMT https://vulnogram.org/CVE-2025-8058 https://vulnogram.org/CVE-2025-8058 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures.… Medium Wed, 23 Jul 2025 19:57:17 GMT https://vulnogram.org/CVE-2025-5745 https://vulnogram.org/CVE-2025-5745 The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the pow… Medium Network Exploitable Thu, 05 Jun 2025 19:20:23 GMT https://vulnogram.org/CVE-2025-5702 https://vulnogram.org/CVE-2025-5702 The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powe… Medium Network Exploitable Thu, 05 Jun 2025 18:23:57 GMT https://vulnogram.org/CVE-2025-4802 https://vulnogram.org/CVE-2025-4802 Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen… High Fri, 16 May 2025 19:32:50 GMT https://vulnogram.org/CVE-2025-0395 https://vulnogram.org/CVE-2025-0395 When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to pag… Medium Wed, 22 Jan 2025 13:11:30 GMT https://vulnogram.org/CVE-2024-33602 https://vulnogram.org/CVE-2024-33602 nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 w… High Mon, 06 May 2024 19:22:12 GMT https://vulnogram.org/CVE-2024-33601 https://vulnogram.org/CVE-2024-33601 nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a deni… High Network Exploitable Mon, 06 May 2024 19:22:07 GMT https://vulnogram.org/CVE-2024-33600 https://vulnogram.org/CVE-2024-33600 nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc… Medium Network Exploitable Mon, 06 May 2024 19:22:02 GMT https://vulnogram.org/CVE-2024-33599 https://vulnogram.org/CVE-2024-33599 nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw w… High Network Exploitable Mon, 06 May 2024 19:21:54 GMT https://vulnogram.org/CVE-2024-2961 https://vulnogram.org/CVE-2024-2961 The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neig… High Wed, 17 Apr 2024 17:27:40 GMT