CVE-2026-95818

A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory.

Red Hat Product Security has rated this vulnerability as Moderate because exploitation requires local access and depends on the presence of privileged binaries compiled with specific path directives. Default Red Hat Enterprise Linux installations do not typically ship setuid or setgid binaries containing origin-relative runtime paths, substantially limiting the practical attack surface. As a result, the primary exposure is confined to environments hosting custom or third-party privileged software configured with these unusual search attributes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.