IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
3.6Baja

CVE-2026-95818AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc Publicada: (hace 1 mes)

Descripción

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

Debilidad (CWE): CWE-121

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
The GNU C Library glibc 2.14 – < 2.45

Correcciones de Ubuntu

  • USN-9065-1 GNU C Library vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 12.11.2026 · glibc

Referencias y parches

CVE recientes del mismo producto — Ubuntu 22.04 LTS

7.7Alta
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.8Alta
CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.