A stack-based buffer overflow sits in the dynamic loader of glibc. The flaw is triggered when a setuid or setgid program has an RPATH or RUNPATH that begins with $ORIGIN followed by a NUL or slash. The loader reads beyond the end of the path string and writes past the end of an internal stack buffer, which can corrupt the loader’s stack. The consequences are a crash of the loader—causing a denial of service—and limited leakage of process memory.

The affected library is the GNU C Library (glibc) for versions 2.14 through 2.44. Any local user who can run a setuid or setgid application that contains a vulnerable RPATH or RUNPATH may be able to trigger the overflow. Systems that rely on these glibc versions and have such privileged programs are at risk.

The CVSS score of 3.6 indicates moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation is uncertain. The vulnerability is only exploitable from the local context because it requires execution of a setuid/ setgid binary that uses $ORIGIN in its run‑time library path. The vulnerability is not listed in the CISA KEV set, suggesting no known widespread exploitation yet. Nevertheless, the stack corruption introduces a risk of denial of service and potential local information disclosure.