CVE-2026-5358: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in The GNU C Library glibc
CVE-2026-5358 is a buffer overflow vulnerability in the obsolete nis_local_principal function of the GNU C Library (glibc) version 2. 43 and older. This function may overflow a buffer in the data section when processing crafted UDP responses, potentially allowing an attacker to overwrite neighboring static data in the requesting application. NIS support in glibc has been deprecated since version 2. 26 and is maintained only for legacy use. There is no confirmed patch or official remediation available at this time.
AI Analysis
Technical Summary
The vulnerability exists in the nis_local_principal function of glibc versions 2.43 and earlier, where a buffer overflow can occur due to unchecked input size when handling UDP responses. This classic buffer overflow (CWE-120) could enable an attacker to spoof a crafted UDP response and overwrite static data in the application memory space. Since NIS support is obsolete and deprecated since glibc 2.26, the function is intended only for legacy compatibility. No CVSS score or vendor advisory patch information is currently available.
Potential Impact
An attacker able to send a crafted UDP response to an application using the vulnerable nis_local_principal function could exploit the buffer overflow to overwrite static data in the application's memory. This could lead to application instability, data corruption, or potentially code execution depending on the application context. However, the vulnerability affects only legacy NIS-related functionality, which is deprecated and not commonly used in modern environments.
Mitigation Recommendations
No official patch or remediation has been confirmed at this time. Since NIS support is deprecated and maintained only for legacy purposes, the recommended mitigation is to port applications away from NIS to modern identity and access management services. Users should monitor the GNU C Library vendor advisories for any future patches or updates addressing this issue.
CVE-2026-5358: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in The GNU C Library glibc
Description
CVE-2026-5358 is a buffer overflow vulnerability in the obsolete nis_local_principal function of the GNU C Library (glibc) version 2. 43 and older. This function may overflow a buffer in the data section when processing crafted UDP responses, potentially allowing an attacker to overwrite neighboring static data in the requesting application. NIS support in glibc has been deprecated since version 2. 26 and is maintained only for legacy use. There is no confirmed patch or official remediation available at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the nis_local_principal function of glibc versions 2.43 and earlier, where a buffer overflow can occur due to unchecked input size when handling UDP responses. This classic buffer overflow (CWE-120) could enable an attacker to spoof a crafted UDP response and overwrite static data in the application memory space. Since NIS support is obsolete and deprecated since glibc 2.26, the function is intended only for legacy compatibility. No CVSS score or vendor advisory patch information is currently available.
Potential Impact
An attacker able to send a crafted UDP response to an application using the vulnerable nis_local_principal function could exploit the buffer overflow to overwrite static data in the application's memory. This could lead to application instability, data corruption, or potentially code execution depending on the application context. However, the vulnerability affects only legacy NIS-related functionality, which is deprecated and not commonly used in modern environments.
Mitigation Recommendations
No official patch or remediation has been confirmed at this time. Since NIS support is deprecated and maintained only for legacy purposes, the recommended mitigation is to port applications away from NIS to modern identity and access management services. Users should monitor the GNU C Library vendor advisories for any future patches or updates addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- glibc
- Date Reserved
- 2026-04-01T17:07:51.437Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e6941f19fe3cd2cd32c49d
Added to database: 4/20/2026, 9:01:19 PM
Last enriched: 4/20/2026, 9:16:31 PM
Last updated: 4/20/2026, 10:41:33 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.