CVE-2026-86805

The GNU C Library (glibc) versions 2.14 through 2.44 contain a time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so ). When processing setuid/setgid (AT_SECURE) programs, the loader validates a lexically normalized search path for $ORIGIN in DT_RPATH but subsequently ...

PT-2026-104834

A stack-based buffer overflow in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid AT SECURE programs. When such a program's DT RPATH or DT RUNPATH begins with $ORIGIN and is followed by NUL or '/...

Unity Linux 20.1070e Security Update: glibc (UTSA-2022-002147)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-002147 advisory. The deprecated compatibility function svcunixcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its path argument on the stack without...

Unity Linux 20.1070e Security Update: glibc (UTSA-2022-002148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-002148 advisory. The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its hostname argument on the stack without...

CVE-2026-86805: Time-of-check Time-of-use (TOCTOU) Race Condition

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CVE-2026-95818: Stack-based Buffer Overflow

A stack-based buffer overflow in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid ATSECURE programs. When such a program's DTRPATH or DTRUNPATH begins with $ORIGIN and is followed by NUL or '/' t...

PT-2026-104833

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT RPATH for setuid/setgid AT SECURE programs, glibc validates the lexically normalized...

PT-2026-96840

Name of the Vulnerable Software and Affected Versions glibc versions 2.14 through 2.44 Description A stack-based buffer overflow exists in the dynamic loader ld.so of the GNU C Library. This issue occurs when a setuid/setgid AT SECURE program has a DT RPATH or DT RUNPATH that starts with $ORIGIN...

PT-2026-96830

Name of the Vulnerable Software and Affected Versions glibc versions 2.14 through 2.44 Description A time-of-check to time-of-use TOCTOU race condition exists in the dynamic loader ld.so. This occurs when expanding $ORIGIN in DT RPATH for setuid/setgid AT SECURE programs; the system validates the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: glibc (UTSA-2026-090401)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090401 advisory. The wordexp function in the GNU C Library aka glibc through 2.33 may crash or read arbitrary memory in parseparam in posix/wordexp.c when called with an untrusted,...

CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in glibc 2.34, netty-codec-http 4.1.x, ncurses 6.2, and net/http

Summary glibc, netty-codec-http, ncurses, and net/http are bundled with IBM Optim as OS base image and application runtime dependencies. CVE-2026-0861 is an integer overflow in glibc that may cause heap corruption; CVE-2025-58056 is an HTTP request smuggling flaw in Netty; CVE-2022-29458 is an...

glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration

A flaw was found in the GNU C Library glibc DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: glibc: compat-libpthread-nonshared-2.43-8.6.hum1 aarch64, x8664 glibc-2.43-8.6.hum1 aarch64, x8664 glibc-all-langpacks-2.43-8.6.hum1 aarch64, x8664 glibc-benchtests-2.43-8.6.hum1 aarch64, x8664...

CVE-2025-4802-Proof-of-Concept

CVE-2025-4802 — Prueba de Concepto ⚠️ Aviso: Este repositorio es solo para fines educativos y de investigación de seguridad autorizados. No use este exploit contra sistemas que no posea o para los que no tenga permiso explícito para probar. El uso indebido puede violar leyes y regulaciones. Resume...

EulerOS Virtualization 2.10.0 : glibc (EulerOS-SA-2026-3867)

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that...

EulerOS Virtualization 2.10.1 : glibc (EulerOS-SA-2026-3832)

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to enforce the...

EulerOS Virtualization 2.10.0 : gawk (EulerOS-SA-2026-3866)

According to the versions of the gawk packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to enforce the...

OESA-2026-3921 glibc security update

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...

EulerOS 2.0 SP10 : glibc (EulerOS-SA-2026-3737)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer...