CVE-2018-11236: Integer Overflow
Last updated 25 August 2025
Other sources
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/glibcto a version that resolves this vulnerability.Fixed in 2.28 - Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u11Fixed in 2.31-13+deb11u14Fixed in 2.36-9+deb12u14Fixed in 2.36-9+deb12u7Fixed in 2.41-12+deb13u3Fixed in 2.42-17 - Upgrade
Upgrade
stdlib/canonicalize.c (GNU C Library / glibc / libc6)to a version that resolves this vulnerability.Fixed in 2.27
Event History
Frequently Asked Questions
What is CVE-2018-11236?
CVE-2018-11236 is a vulnerability in the GNU C Library (glibc) that could allow for arbitrary code execution.
How severe is CVE-2018-11236?
CVE-2018-11236 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2018-11236?
The affected software versions include glibc 2.27 and earlier.
How can I fix CVE-2018-11236?
To fix CVE-2018-11236, update your glibc installation to version 2.28 or higher.
Where can I find more information about CVE-2018-11236?
You can find more information about CVE-2018-11236 at the following references: [Link 1](https://sourceware.org/bugzilla/show_bug.cgi?id=22786), [Link 2](https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5460617d1567657621107d895ee2dd83bc1f88f2), [Link 3](http://www.securityfocus.com/bid/104255)