Out-of-bounds read in GNU C Library (glibc) - CVE-2026-4437

Vulnerability identifier: #VU124259

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:U/U:Green]

CVE-ID: CVE-2026-4437

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to a boundary condition when calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version. A remote attacker can send a specially crafted response from the configured DNS server and perform a spoofing attack.

GNU C Library (glibc)
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
Development Tools Module
openSUSE Leap
Anolis OS
openEuler
glibc-doc
compat-libpthread-nonshared
glibc
glibc-all-langpacks
glibc-benchtests
glibc-common
glibc-devel
glibc-gconv-extra
glibc-langpack-en
glibc-langpack-zh
glibc-minimal-langpack
glibc-locale-source
nss_hesiod
nss_db
libnsl
glibc-utils
glibc-static
glibc-nss-devel
nscd
nss_modules
glibc-help
glibc-debuginfo
glibc-debugsource
glibc-debugutils
glibc-locale-archive
glibc-utils-32bit-debuginfo
glibc-devel-static-32bit
glibc-profile-64bit
glibc-64bit-debuginfo
glibc-devel-64bit
libnsl1-64bit-debuginfo
glibc-locale-base-64bit-debuginfo
glibc-utils-64bit-debuginfo
glibc-locale-base-64bit
glibc-devel-static-64bit
glibc-devel-64bit-debuginfo
glibc-64bit
libnsl1-64bit
glibc-utils-64bit
glibc-profile-32bit
glibc-profile
glibc-devel-static
glibc-utils-src-debugsource
glibc-utils-debuginfo
glibc-32bit-debuginfo
glibc-devel-32bit
glibc-devel-32bit-debuginfo
libnsl1-debuginfo
glibc-extra
glibc-extra-debuginfo
glibc-locale-base
libnsl1
nscd-debuginfo
glibc-locale-base-debuginfo
glibc-locale
glibc-devel-debuginfo
glibc-info
glibc-i18ndata
glibc-lang
libnsl1-32bit-debuginfo
libnsl1-32bit
glibc-locale-base-32bit
glibc-locale-base-32bit-debuginfo
glibc-32bit
glibc-html
glibc-utils-32bit

Install updates from vendor's website.

glibc-doc - update to 2.38-20
compat-libpthread-nonshared - update to 2.38-20
glibc - update to 2.38-20
glibc-all-langpacks - update to 2.38-20
glibc-benchtests - update to 2.38-20
glibc-common - update to 2.38-20
glibc-devel - update to 2.38-20
glibc-gconv-extra - update to 2.38-20
glibc-langpack-en - update to 2.38-20
glibc-langpack-zh - update to 2.38-20
glibc-minimal-langpack - update to 2.38-20
glibc-locale-source - update to 2.38-20
nss_hesiod - update to 2.38-20
nss_db - update to 2.38-20
libnsl - update to 2.38-20
glibc-utils - update to 2.38-20
glibc-static - update to 2.38-20
glibc-nss-devel - update to 2.38-20
libnsl - update to 2.38-98
nscd - update to 2.38-98
nss_modules - update to 2.38-98
glibc-help - update to 2.38-98
glibc - update to 2.38-98
glibc-all-langpacks - update to 2.38-98
glibc-common - update to 2.38-98
glibc-debuginfo - update to 2.38-98
glibc-debugsource - update to 2.38-98
glibc-debugutils - update to 2.38-98
glibc-devel - update to 2.38-98
glibc-locale-archive - update to 2.38-98
glibc-locale-source - update to 2.38-98
glibc-nss-devel - update to 2.38-98
glibc-utils-32bit-debuginfo - update to 2.38-150600.14.46.1
glibc-devel-static-32bit - update to 2.38-150600.14.46.1
glibc-profile-64bit - update to 2.38-150600.14.46.1
glibc-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-devel-64bit - update to 2.38-150600.14.46.1
libnsl1-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-utils-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base-64bit - update to 2.38-150600.14.46.1
glibc-devel-static-64bit - update to 2.38-150600.14.46.1
glibc-devel-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-64bit - update to 2.38-150600.14.46.1
libnsl1-64bit - update to 2.38-150600.14.46.1
glibc-utils-64bit - update to 2.38-150600.14.46.1
glibc-profile-32bit - update to 2.38-150600.14.46.1
glibc-profile - update to 2.38-150600.14.46.1
glibc-devel-static - update to 2.38-150600.14.46.1
glibc-debuginfo - update to 2.38-150600.14.46.1
glibc-utils-src-debugsource - update to 2.38-150600.14.46.1
glibc-debugsource - update to 2.38-150600.14.46.1
glibc-utils-debuginfo - update to 2.38-150600.14.46.1
glibc-32bit-debuginfo - update to 2.38-150600.14.46.1
glibc-devel-32bit - update to 2.38-150600.14.46.1
glibc-devel-32bit-debuginfo - update to 2.38-150600.14.46.1
libnsl1-debuginfo - update to 2.38-150600.14.46.1
glibc - update to 2.38-150600.14.46.1
glibc-extra - update to 2.38-150600.14.46.1
nscd - update to 2.38-150600.14.46.1
glibc-extra-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base - update to 2.38-150600.14.46.1
glibc-devel - update to 2.38-150600.14.46.1
glibc-utils - update to 2.38-150600.14.46.1
libnsl1 - update to 2.38-150600.14.46.1
nscd-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base-debuginfo - update to 2.38-150600.14.46.1
glibc-locale - update to 2.38-150600.14.46.1
glibc-devel-debuginfo - update to 2.38-150600.14.46.1
glibc-info - update to 2.38-150600.14.46.1
glibc-i18ndata - update to 2.38-150600.14.46.1
glibc-lang - update to 2.38-150600.14.46.1
libnsl1-32bit-debuginfo - update to 2.38-150600.14.46.1
libnsl1-32bit - update to 2.38-150600.14.46.1
glibc-locale-base-32bit - update to 2.38-150600.14.46.1
glibc-locale-base-32bit-debuginfo - update to 2.38-150600.14.46.1
glibc-32bit - update to 2.38-150600.14.46.1
glibc-html - update to 2.38-150600.14.46.1
glibc-utils-32bit - update to 2.38-150600.14.46.1

• https://sourceware.org/bugzilla/show_bug.cgi?id=34014

• Spoofing attack in GNU C Library
• openEuler 24.03 LTS SP3 update for glibc
• openEuler 24.03 LTS SP2 update for glibc
• openEuler 24.03 LTS SP1 update for glibc
• openEuler 24.03 LTS update for glibc
• SUSE update for glibc
• Anolis OS update for glibc