peter bassill · operator
$ cve CVE-2018-11236 JSON

CVE-2018-11236

9.8
CRITICAL · CVSS 3.0 · EPSS 7.1% (pctl 94)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

Scoring

CVSS9.8 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS7.05% — more likely to be exploited than 94% of all CVEs
WeaknessCWE-190
On CISA KEVno
Public exploitnone known
Published2018-05-18
Last modified2026-06-17

Affected (9)

VendorProduct
gnuglibc
netappdata ontap edge
netappelement software management
oraclecommunications session border controller
oracleenterprise communications broker
redhatenterprise linux desktop
redhatenterprise linux server
redhatenterprise linux workstation
redhatvirtualization host

References

→ the Explorer  ·  watch your stack  ·  NVD