November 21, 2023 · Applied Cybernetics Group
CVE-2023-4911 — GNU GNU C Library
GNU C Library Buffer Overflow Vulnerability
- Added to KEV
2023-11-21- Federal due date
2023-12-12- Vendor
- GNU
- Product
- GNU C Library
- EPSS
- 98.4th percentile (score 0.622, as of
2026-06-08) - NVD CVSS v3.1
- 7.8 (HIGH)
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2023-4911
CISA short description
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
NVD description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.