CVE-2026-5435: GNU C Library Buffer Overflow Vulnerability

CVE-2026-5435 Overview

CVE-2026-5435 is an out-of-bounds write vulnerability affecting the GNU C Library (glibc) version 2.2 and newer. The deprecated functions ns_printrrf, ns_printrr, and fp_nquery fail to properly enforce caller-supplied buffer length constraints, which can result in memory corruption when processing TSIG (Transaction Signature) DNS records.

Critical Impact

Applications using deprecated glibc DNS resolver functions are susceptible to out-of-bounds write conditions when handling maliciously crafted TSIG records, potentially leading to arbitrary code execution or denial of service.

Affected Products

• GNU C Library (glibc) version 2.2 and newer
• Linux distributions using affected glibc versions
• Applications utilizing ns_printrrf, ns_printrr, or fp_nquery functions

Discovery Timeline

• 2026-04-28 - CVE-2026-5435 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-5435

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write), a memory safety issue that occurs when the deprecated DNS resolver printing functions in glibc do not properly validate that output data fits within the caller-provided buffer boundaries. When these functions process TSIG records—a type of DNS resource record used for transaction authentication—they can write beyond the allocated buffer space.

The functions ns_printrrf, ns_printrr, and fp_nquery are part of the legacy resolver library interface and have been deprecated for some time. However, legacy applications may still depend on these functions for DNS record formatting and display operations. The failure to enforce buffer length constraints means that specially crafted DNS responses containing TSIG records can trigger memory corruption.

The vulnerability can be triggered remotely via network-based attack vectors, as malicious DNS responses can be delivered to applications performing DNS queries. The attack requires no authentication or user interaction, making it particularly dangerous for network-facing services that process DNS data using these deprecated functions.

Root Cause

The root cause of CVE-2026-5435 lies in insufficient bounds checking within the buffer writing logic of the deprecated resolver printing functions. When formatting TSIG record data for output, these functions fail to verify that the destination buffer has adequate capacity before performing write operations. This oversight allows data to overflow the intended buffer boundaries when processing records with unexpectedly large or malformed content.

Attack Vector

An attacker can exploit this vulnerability by delivering malicious DNS responses to a target application. The attack scenario involves:

1. The target application makes a DNS query using glibc's resolver functions
2. An attacker positioned as a man-in-the-middle or controlling a malicious DNS server responds with crafted TSIG records
3. When the application processes this response using ns_printrrf, ns_printrr, or fp_nquery, the oversized TSIG data overflows the provided buffer
4. The out-of-bounds write corrupts adjacent memory, potentially allowing code execution or causing application crashes

The vulnerability mechanism centers on TSIG record processing within the deprecated resolver functions. When these functions encounter TSIG records during DNS response formatting, they write the formatted output to a caller-supplied buffer without adequately checking that the buffer has sufficient space. Technical details are available in the Sourceware Bug Report #34033.

Detection Methods for CVE-2026-5435

Indicators of Compromise

• Unexpected application crashes or segmentation faults in processes performing DNS operations
• Anomalous DNS traffic patterns, particularly responses containing unusually large or malformed TSIG records
• Memory corruption artifacts in crash dumps from applications using glibc resolver functions
• Increased DNS query failures or timeouts in affected systems

Detection Strategies

• Monitor for use of deprecated glibc resolver functions (ns_printrrf, ns_printrr, fp_nquery) in application binaries through static analysis
• Deploy network intrusion detection rules to identify anomalous DNS TSIG record sizes in responses
• Implement runtime memory protection tools (AddressSanitizer, Valgrind) to detect out-of-bounds write attempts
• Review application logs for resolver-related errors or unexpected crashes

Monitoring Recommendations

• Enable memory fault logging and configure core dumps for forensic analysis of potential exploitation attempts
• Monitor DNS traffic for responses with TSIG records exceeding typical size thresholds
• Track glibc version deployments across infrastructure to identify systems requiring updates
• Implement alerting for application restarts or crashes in DNS-dependent services

How to Mitigate CVE-2026-5435

Immediate Actions Required

• Audit applications to identify usage of deprecated functions ns_printrrf, ns_printrr, and fp_nquery
• Update glibc to the latest patched version when available from your distribution
• Migrate applications to use modern resolver interfaces instead of deprecated functions
• Apply defense-in-depth measures including ASLR, stack canaries, and non-executable memory protections

Patch Information

Security updates addressing CVE-2026-5435 are being coordinated through the glibc project. Users should monitor the Sourceware libc Announcement for official patch releases. Linux distribution maintainers will provide updated glibc packages through their respective security update channels.

Workarounds

• Refactor applications to replace deprecated resolver printing functions with modern alternatives
• Implement application-level input validation for DNS responses before processing
• Deploy network filtering to sanitize DNS responses from untrusted sources
• Consider using alternative DNS resolver libraries that do not have this vulnerability

# Configuration example
# Identify applications using deprecated glibc resolver functions
nm -D /path/to/application | grep -E "ns_printrrf|ns_printrr|fp_nquery"

# Check installed glibc version
ldd --version

# Enable memory protection features in the kernel
echo 2 > /proc/sys/kernel/randomize_va_space