The obsolete nis_local_principal function in the GNU C Library (glibc) up to version 2.43 may overflow a static buffer in the data section. This overflow can allow an attacker to craft a malicious UDP response that overwrites neighboring static data used by the requesting application. Such memory corruption can lead to arbitrary code execution or privilege escalation if the overwritten data influences program control flows. The vulnerability is a classic stack or data segment overflow (CWE‑120).

The affected product is the GNU C Library, also known as glibc. Versions 2.43 and all earlier releases contain the vulnerable nis_local_principal implementation. NIS support was deprecated in glibc 2.26 but is still maintained for legacy use.

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 9.1, but a buffer overflow of this nature is generally considered high impact. Because the exploit requires triggering a UDP request processed by the deprecated NIS function, it is likely limited to environments that still enable NIS. No public exploits have been reported, but the potential for remote code execution exists if an attacker can induce the application to process a crafted NIS response.