GNU C Library Buffer Overflow Vulnerability

What it is

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Why we say that

• EPSS puts exploitation in the next 30 days at 81%
• 1 public exploit published
• CISA's federal remediation deadline (2023-12-12) has passed
• Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Indexed from Exploit-DB. Presence of code raises urgency; absence does not mean safety.

• glibc 2.38 - Buffer Overflow local · linux · 2026-02-11