CVE-2023-4911: GNU C Library ld.so GLIBC_TUNABLES heap buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation to root with public exploits, KEV listing and very high EPSS, though it requires local access rather than being remotely exploitable.

What it is

The GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds write. A local attacker can craft malicious GLIBC_TUNABLES values and launch a SUID binary to execute code with elevated privileges. It affects glibc and numerous downstream distributions and products, making it a widespread local privilege escalation issue.

Impact

An attacker with local access gains code execution at the privileges of the targeted SUID binary, typically root. This yields full control of the host and a strong foothold for lateral movement or persistence.

Attack surface

Reached locally by setting the GLIBC_TUNABLES environment variable and executing a SUID-permission binary; no network access or user interaction is required. The CVSS vector shows low privileges (PR:L) and no user interaction (UI:N).

Exploitation

CISA added it to KEV on 2023-11-21 with a 2023-12-12 remediation due date, and EPSS shows a 30-day probability of 0.81422 (99.6th percentile). Multiple references are tagged Exploit, including the Qualys advisory and public exploit postings.

What to do

• Patch glibc and all affected vendor packages (Red Hat, Canonical, Debian, Fedora, NetApp, Siemens) to the fixed versions listed in the vendor advisories.
• If patching cannot be completed immediately, follow vendor mitigation guidance or discontinue use of affected products per the CISA KEV required action.
• Restrict local interactive access and limit which users can run SUID binaries on affected hosts.
• Audit and remove unnecessary SUID binaries to reduce the attack surface for this and similar flaws.
• Track the CISA KEV due date of 2023-12-12 and verify remediation across all affected systems.

Detection

• Monitor process execution for SUID binaries launched with unusual GLIBC_TUNABLES environment values.
• Alert on unexpected privilege escalation or root-level process creation from non-privileged user contexts.
• Check installed glibc versions against vendor fixed releases and report unpatched hosts.
• Review audit logs for suspicious environment variable manipulation preceding SUID execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.