The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
stack overflow when a malicious DNS server returns too large a response
for a DNS query, resulting in degraded DNS resolution for the system.
Exploitation of this bug needs a system that has nscd enabled and using
an untrusted DNS server for name resolution, with the compromised DNS
server being capable of processing records large enough to result in a
stack overflow in an nscd thread stack. During experimentation, bind 9
was unable to handle large records, but that could change in future or
with a different name server. In typical installations, nscd is
executed in an isolated context as its own user without a shell, due to
which any compromise of that service is isolated.
There is a remote possibility of nscd cache corruption if an attacker
manages to get the stack pointer into a desired point in the heap,
potentially resulting in other caches in nscd being overwritten with
corrupt data through the stack overflow, until the buggy code path
eventually results in a crash.
Finally, a crash in nscd may result in performance degradation when
resolving names, but it does not result in a denial of service.
References
Configurations
No configuration.
History
No history.
Information
Published : 2026-09-11 02:18
Updated : 2026-09-11 18:17
NVD link : CVE-2026-89092
Mitre link : CVE-2026-89092
CVE.ORG link : CVE-2026-89092
JSON object : View
Products Affected
No product.
CWE
CWE-789
Memory Allocation with Excessive Size Value