CVE-2026-95818: AT_SECURE program buffer overflow via $ORIGIN processing
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (ATSECURE) programs.
When such a program's DTRPATH or DTRUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Affected Software
Event History
Frequently Asked Questions
Which systems and binaries should be prioritized for assessment?
Prioritize systems using glibc versions 2.14 through 2.44 that run setuid or setgid programs. Within those programs, the relevant condition is a DT_RPATH or DT_RUNPATH entry that starts with $ORIGIN and is immediately followed by either a NUL byte or '/'.
What level of access does exploitation require, and what is the expected impact?
Exploitation requires local access, low privileges, and high attack complexity; no user interaction is required. The reported effects are dynamic-loader crashes, corruption of loader memory, and limited disclosure of process memory.