High severity · published May 16, 2025
CVE-2025-4802
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in…
7.8
CVSS
0.6%
EPSS
No
On KEV
Description
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glibc · Gnu
2.27 through 2.38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4802
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4802
Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=32976
Patch
https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e
Mailing List
http://www.openwall.com/lists/oss-security/2025/05/16/7
Exploit
http://www.openwall.com/lists/oss-security/2025/05/17/2
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html
More from Glibc
7.8
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
9.8
CVE-2023-0687
A vulnerability was found in GNU C Library 2.38
9.8
CVE-2023-25139
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size
9.8
CVE-2022-23218
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating…