A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory.
Last checked: 2026-09-22 21:40 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-22 18:21 UTC)
Fix evidence last checked: 2026-09-29 00:24 UTC