Executive brief
A vulnerability in a core Linux system library (glibc) could allow an attacker to provide a malicious network name that contains hidden commands. If a program uses this library to look up a computer's name and then passes that name to a command-line script, the attacker could potentially execute unauthorized actions on the system. This risk is primarily present if an attacker has already compromised a local network's DNS server or is positioned to intercept network traffic.
Technical details
A defect in the getanswer_ptr function within resolv/nss_dns/dns-host.c causes glibc to accept invalid DNS hostnames from PTR records. The root cause is an improper validation check where __res_binary_hnok was called against the 'expected_name' (the query) rather than the 'name_buffer' (the response). An attacker who controls a DNS server or can perform a man-in-the-middle attack could return a hostname containing shell metacharacters. If the calling application subsequently uses this hostname in a shell-executed command without sanitization, it could lead to shell injection. The vulnerability affects glibc versions 2.34 through 2.43 and has been addressed in version 2.44 and subsequent patches.
Affected products
- GNU glibc 2.34 to 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6
Timeline
- 2026-03-20: disclosed: Bug reported to glibc maintainers
- 2026-03-20: advisory: Initial CVE publication
- 2026-03-30: patched: Fix committed to glibc repository
- 2026-07-14: advisory: Siemens updated advisory for SIMATIC S7-1500 products