A flaw in the GNU C Library’s gethostbyaddr and gethostbyaddr_r functions causes them to misinterpret DNS replies when the system’s name service switch points to a DNS backend. A malicious DNS server can send a crafted packet that violates the DNS specification by placing a non‑answer section in the answer position. The library, following its own logic, treats this section as a valid answer, potentially leading to corrupted hostname resolution or an application crash. The weakness maps to CWE‑125 and CWE‑1286.

The vulnerability is present in glibc versions 2.34 through 2.43, whenever the nsswitch.conf file references a DNS backend. All Linux distributions that ship these glibc releases, including Debian, Ubuntu, Red Hill, CentOS, Fedora and others, are affected for any application that links against glibc and uses the gethostbyaddr or gethostbyaddr_r interfaces.

The CVSS base score of 7.5 indicates high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at present. The vulnerability is not yet catalogued in CISA’s KEV list. Exploitation would require control of a DNS server that the victim queries and the ability to deliver a malformed response. The likely attack vector is network‑based remote via DNS; this is inferred from the need for a crafted DNS reply and no requirement for local privileges.