A stack‑based buffer overflow exists in the dynamic loader of the GNU C Library for versions 2.14 through 2.44. The flaw is triggered when a setuid or setgid program has a DT_RPATH or DT_RUNPATH that begins with $ORIGIN and is followed by a NUL or a slash. In this scenario the loader reads beyond the end of the path string and writes beyond the end of an internal stack buffer. This corrupts the loader’s stack and can cause a crash (denial of service) or a limited disclosure of process memory.

The affected library is glibc versions 2.14 through 2.44. Any local user who can execute a setuid or setgid binary that contains a vulnerable RPATH or RUNPATH may trigger the overflow. Systems that rely on these glibc versions and have such privileged programs are at risk.

The CVSS score of 3.6 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability can only be exploited from a local context, requiring the attacker to run a setuid/setgid application that uses $ORIGIN in its runtime library path. It is not listed in the CISA KEV catalog, indicating no widespread exploitation is known, but the stack corruption introduces a risk of denial of service and potential local information disclosure.