CVE-2026-89092
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation requires nscd enabled and using an untrusted DNS server. There is also a remote possibility of nscd cache corruption.
Risk Assessment
A crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. In rare cases, nscd cache corruption may occur, potentially affecting other caches.
Recommendation
Update the GNU C Library to a version containing the fix or disable the nscd service if not required. Avoid using untrusted DNS servers for name resolution.
Other vulnerabilities in GNU C Library
See all- CVE-2026-0861High
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 to 2.42 may result in an integer overflow, which could consequently result in heap corruption. To exploit this, an attacker must control both the size and alignment arguments; the size must be close to PTRDIFF_MAX and the alignment in the range [1<<62+1, 1<<63] (exactly 1<<63 for posix_memalign and aligned_alloc). In practice, alignment is typically not attacker-controlled, making exploitation unlikely.
- CVE-2024-2961High
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.
- CVE-2025-0395Medium
In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.
- CVE-2025-4802Medium
In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).
- CVE-2026-5450Critical
Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.
- CVE-2023-4911HighActively exploited
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- CVE-2020-6096High
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() with a negative value for the 'num' parameter results in a signed comparison vulnerability, potentially leading to out-of-bounds memory writes and remote code execution.
- CVE-2018-19591High
In the GNU C Library (glibc) through version 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
- CVE-2026-84243High
A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.
- CVE-2026-97399Low
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This occurs when attacker-controlled input strings match up to the edge of their page and the neighboring page is either not mapped or not readable.
Original NVD description (English source)
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS