Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

🗓️ 04 Sep 2025 07:02:07Reported by MicrosoftType

Untrusted LD_LIBRARY_PATH in glibc 2.27–2.38 lets attackers load libs in setuid binaries using dlopen

Reporter	Title	Published	Views	Family All 190
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway potentially vulnerable to library path manipulation	22 Dec 202514:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak	8 Nov 202516:02	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to untrusted library loading due to the GNU C library (CVE-2025-4802)	4 Sep 202522:45	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities due to libxml2, python3, pam and glibc packages shipped with IBM CICS TX Standard.	12 Aug 202511:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	3 Jul 202510:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System	3 Jul 202623:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	23 Jul 202517:22	–	ibm
Tenable Nessus	Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-1001)	12 Jun 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0138: glibc (ALINUX3-SA-2025:0138)	19 Aug 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : glibc (ALSA-2025:8655)	12 Jun 202500:00	–	nessus