← Vulnerability feed

Vulnerability record · CVE-2018-11236 · published 18 May 2018

CVE-2018-11236: Gnu glibc integer overflow vulnerability

Gnu · Glibc

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

9.8 CVSS 3.0 Critical EPSS 7.1% · top 6.0% CWE-190 · Integer overflowCWE-787 · Out-of-bounds write
9.8CVSS 3.0 base score, v2 7.5
7.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
9Affected product versions listed by NVD
18References
17 Jun 2026Last modified by NVD

Description

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/104255 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3092 PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20190329-0001/ Broken Link
https://security.netapp.com/advisory/ntap-20190401-0001/ Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=22786 Issue TrackingThird Party Advisory
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2
https://usn.ubuntu.com/4416-1/
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory
http://www.securityfocus.com/bid/104255 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3092 PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20190329-0001/ Broken Link
https://security.netapp.com/advisory/ntap-20190401-0001/ Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=22786 Issue TrackingThird Party Advisory
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2
https://usn.ubuntu.com/4416-1/
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory

Track CVE-2018-11236 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 81%analysed10.0CVE-2015-0235glibc gethostbyname heap buffer overflow (GHOST)CVE-2015-0235 is a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2 and other 2.x versions before 2.18. It is reach…EPSS 95%analysed9.8CVE-2026-5450Gnu glibc heap-based buffer overflow vulnerabilityCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width spec…EPSS 0.72%9.8CVE-2023-0687Gnu glibc classic buffer overflow vulnerabilityA vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file g…EPSS 1.1%9.8CVE-2023-25139Gnu glibc out-of-bounds write vulnerabilitysprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelate…EPSS 1.4%9.8CVE-2022-23218Gnu glibc classic buffer overflow vulnerabilityThe deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on t…EPSS 4.8%9.8CVE-2022-23219Gnu glibc classic buffer overflow vulnerabilityThe deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on …EPSS 4.3%9.8CVE-2021-3711OpenSSL SM2 decryption buffer overflowOpenSSL's SM2 decryption code miscalculates the output buffer size needed by EVP_PKEY_decrypt(), so the first sizing call can return a value smaller …EPSS 88%analysed

Source: NIST National Vulnerability Database (record CVE-2018-11236), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.