CVE-2026-95818

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-95818

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95818.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-95818

Downstream

Published

2026-09-22T16:50:07Z

Modified

2026-09-23T03:47:33Z

Severity

3.6 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

AT_SECURE program buffer overflow via $ORIGIN processing

Details

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

Database specific

{
    "cna_assigner":  "glibc",
    "cwe_ids":  [
        "CWE-121"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95818.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.14"
                },
                {
                    "fixed":  "2.45"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / sourceware.org/git/glibc.git

Affected ranges

Type

GIT

Repo

https://sourceware.org/git/glibc.git

Events

Introduced

356f8bc660a154a07b03da7c536831da5c8f74fe

Fixed

c3a3a9808ad3ab4a3336836833f83288b672ccbf

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.14"
        },
        {
            "fixed":  "2.44"
        }
    ],
    "source":  "DESCRIPTION"
}

Affected versions

Other

changelog-ends-here

glibc-2.*

glibc-2.14

glibc-2.14.9000

glibc-2.15

glibc-2.16

glibc-2.16-ports-merge

glibc-2.16-tps

glibc-2.16.0

glibc-2.16.90

glibc-2.17

glibc-2.17.90

glibc-2.18

glibc-2.18.90

glibc-2.19

glibc-2.19.90

glibc-2.20

glibc-2.20.90

glibc-2.21

glibc-2.21.90

glibc-2.22

glibc-2.22.90

glibc-2.23

glibc-2.23.90

glibc-2.24

glibc-2.24.90

glibc-2.25

glibc-2.25.90

glibc-2.26

glibc-2.26.9000

glibc-2.27

glibc-2.27.9000

glibc-2.28

glibc-2.28.9000

glibc-2.29

glibc-2.29.9000

glibc-2.30

glibc-2.30.9000

glibc-2.31

glibc-2.31.9000

glibc-2.32

glibc-2.32.9000

glibc-2.33

glibc-2.33.9000

glibc-2.34

glibc-2.34.9000

glibc-2.35

glibc-2.35.9000

glibc-2.36

glibc-2.36.9000

glibc-2.37

glibc-2.37.9000

glibc-2.38

glibc-2.38.9000

glibc-2.39

glibc-2.39.9000

glibc-2.40

glibc-2.40.9000

glibc-2.41

glibc-2.41.9000

glibc-2.42

glibc-2.42.9000

glibc-2.43

glibc-2.43.9000

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95818.json"