The glibc functions ns_printrrf, ns_printrr, and fp_nquery do not validate the length of the RDATA field against the actual data present in a DNS response when handling LOC, CERT, TKEY, or TSIG records. An attacker who can influence a DNS response destined for an application that calls one of these functions could trigger a buffer overread, causing the application to read uninitialized memory or crash. This vulnerability corresponds to CWE-126 (Uninitialized Memory Read) and CWE-1284 (Buffer Over-read) and represents an uninitialized memory read that is potentially exploitable for denial of service or information disclosure.

Affected vendor: GNU C Library (glibc). All glibc releases from version 2.2 onward contain the vulnerable functions. The functions were deprecated in glibc 2.34, but remain in the code base for backward compatibility. Any application that calls these debugging functions—usually for diagnostic purposes—may be affected.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1% shows a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could craft a DNS response containing corrupted RDATA for LOC, CERT, TKEY, or TSIG records that is processed by an application using the deprecated debug functions ns_printrrf, ns_printrr, or fp_nquery. Because these functions are intended only for debugging and normally not called by the DNS resolver, the exploitation path is narrow; an attacker would need to trigger the use of these functions in a live application. If an application does not invoke them, the risk is effectively zero. When invoked, the vulnerability can cause a buffer overread that may lead to a crash or unintended disclosure of memory contents.