CVE-2015-7547: glibc libresolv getaddrinfo stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityAlthough not in CISA KEV, the flaw is remotely reachable without authentication in a ubiquitous library and EPSS shows a very high exploitation probability.

What it is

Multiple stack-based buffer overflows exist in the send_dg and send_vc functions of the libresolv library in GNU C Library (glibc) before 2.23. A crafted DNS response can trigger the overflow when getaddrinfo is called with the AF_UNSPEC or AF_INET6 address family, related to dual A/AAAA DNS queries and the libnss_dns.so.2 NSS module. This is a widely deployed core library, so any application performing DNS resolution through getaddrinfo is potentially exposed.

Impact

A remote attacker can cause a denial of service (crash) or possibly execute arbitrary code in the context of the vulnerable process. Because glibc is used by a broad range of applications and services, successful exploitation could lead to full compromise of the affected host or service.

Attack surface

The flaw is reached over the network via a crafted DNS response processed by a vulnerable application calling getaddrinfo with AF_UNSPEC or AF_INET6. No authentication or user interaction is required per the CVSS vector (AV:N/AC:H/PR:N/UI:N).

Exploitation

CVE-2015-7547 is not listed in CISA KEV, but EPSS indicates a very high probability of exploitation activity (0.90987, 99.8th percentile). Reference tags are mostly Third Party Advisory with no explicit exploit tag, so public exploit availability is not confirmed by the record.

What to do

• Patch glibc to version 2.23 or later, or apply the vendor-supplied security update for your distribution (Red Hat, Debian, Ubuntu, SUSE, Oracle, etc.).
• If immediate patching is not possible, restrict or monitor outbound DNS traffic and avoid untrusted DNS resolvers where feasible.
• Apply vendor mitigations such as disabling or limiting the use of getaddrinfo with AF_UNSPEC/AF_INET6 in affected applications where practical.
• Inventory systems and containers using glibc before 2.23, including appliances and embedded products from listed vendors, and prioritize internet-facing and multi-tenant systems.
• Reboot or restart affected services after patching to ensure the updated library is loaded.

Detection

• Monitor for crashes or abnormal terminations of processes that perform DNS resolution, especially those using getaddrinfo.
• Inspect DNS response traffic for unusually large or malformed responses that could trigger the overflow in libresolv.
• Track glibc versions across hosts and containers to identify systems still running versions before 2.23.
• Review vendor advisories and errata for CVE-2015-7547 to confirm patch status on affected products.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.