What it is
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other GNU entries on the list
- InetUtils GNU InetUtils Argument Injection Vulnerability CVE-2026-24061 · Jan 26, 2026
- GNU Bash GNU Bash OS Command Injection Vulnerability CVE-2014-6278 · Oct 2, 2025
- Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability CVE-2014-7169 · Jan 28, 2022
- Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability CVE-2014-6271 · Jan 28, 2022