CVE-2026-4438: GNU glibc improper input validation in gethostbyaddr

CVE-2026-4438 · Severity: medium · CVSS 5.4 · Published 2026-03-20

A vulnerability in a core Linux system library (glibc) could allow an attacker to provide a malicious network name that contains hidden commands. If a program uses this library to look up a computer's name and then passes that name to a command-line script, the attacker could potentially execute unauthorized actions on the system. This risk is primarily present if an attacker has already compromised a local network's DNS server or is positioned to intercept network traffic.

Technologies: Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Gnu, Siemens.

Quick answers

Is CVE-2026-4438 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4438 being exploited in the wild.
How severe is CVE-2026-4438?
Medium severity, with a CVSS score of 5.4, published 20 March 2026.
Which products and versions are affected?
Gnu Glibc 2.34 to 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6.
Is there a fix for CVE-2026-4438?
A patch was published on 2026-03-30: Fix committed to glibc repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4438 attacked?
It is attacked from the adjacent network or over the network, in a software library.
Am I affected by CVE-2026-4438?
Check whether you run Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A defect in the getanswer_ptr function within resolv/nss_dns/dns-host.c causes glibc to accept invalid DNS hostnames from PTR records. The root cause is an improper validation check where __res_binary_hnok was called against the 'expected_name' (the query) rather than the 'name_buffer' (the response). An attacker who controls a DNS server or can perform a man-in-the-middle attack could return a hostname containing shell metacharacters. If the calling application subsequently uses this hostname in a shell-executed command without sanitization, it could lead to shell injection. The vulnerability affects glibc versions 2.34 through 2.43 and has been addressed in version 2.44 and subsequent patches.

Affected products

  • GNU glibc 2.34 to 2.43
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6

Timeline

  • 2026-03-20: disclosed: Bug reported to glibc maintainers
  • 2026-03-20: advisory: Initial CVE publication
  • 2026-03-30: patched: Fix committed to glibc repository
  • 2026-07-14: advisory: Siemens updated advisory for SIMATIC S7-1500 products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.