ACTIVELY EXPLOITED
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability
| Vendor | GNU |
|---|---|
| Product | GNU C Library |
| Actively exploited | Yes |
| Added to CISA KEV | 21 Nov 2023 |
| CISA federal deadline | 12 Dec 2023 |
| Weakness (CWE) | CWE-122 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
SOURCES
Other GNU flaws
- CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability
- CVE-2014-6278: GNU Bash OS Command Injection Vulnerability
- CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
- CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.