Glibc ld.so overflow hits setuid programs via $ORIGIN paths

The GNU C Library has published an advisory for CVE-2026-95818, a stack buffer overflow in the dynamic loader that affects setuid and setgid programs on glibc 2.14 through 2.44.

The flaw is in how ld.so handles $ORIGIN in a binary's DT_RPATH or DT_RUNPATH. When that token sits at the start of the path and is immediately followed by a NUL or a slash, the loader reads past the end of the path buffer and writes past a stack-allocated internal buffer. On AT_SECURE programs, that can crash the loader or leave limited process memory exposed. Exploitation requires local access and is rated low severity (CVSS 3.6).

AISLE reported the issue in partnership with Red Hat. The overflow is fixed in glibc 2.45. Operators still on 2.14-2.44 should treat setuid/setgid binaries that embed $ORIGIN-based rpath as the practical risk surface until they upgrade.