Bug 2459855 (CVE-2026-5358) - CVE-2026-5358 glibc: glibc: Data corruption or denial of service via buffer overflow in nis_local_principal function
Summary: CVE-2026-5358 glibc: glibc: Data corruption or denial of service via buffer o...
Keywords:
Status: NEW
Alias: CVE-2026-5358
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2460553
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-20 21:02 UTC by OSIDB Bzimport
Modified: 2026-05-01 13:15 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-20 21:02:04 UTC 
The obsolete nis_local_principal function in the GNU C Library version 2.43 and older may overflow a buffer in the data section, which could allow an attacker to spoof a crafted response to a UDP request generated by this function and overwrite neighboring static data in the requesting application.

NIS support is obsolete and has been deprecated in the GNU C Library since version 2.26 and is only maintained for legacy usage. Applications should port away from NIS to more modern identity and access management services.
Comment 3 Carlos O'Donell 2026-05-01 13:15:55 UTC 
CVE-2026-5358 has been marked rejected by upstream.

https://www.cve.org/CVERecord?id=CVE-2026-5358
Note You need to log in before you can comment on or make changes to this bug.