{"id":"CVE-2025-4802","details":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","modified":"2026-08-28T11:46:45.304297104Z","published":"2025-05-16T19:32:50.586Z","related":["ALSA-2025:8655","ALSA-2025:8686","SUSE-SU-2025:01702-1","SUSE-SU-2025:01702-2","SUSE-SU-2025:01784-1","SUSE-SU-2025:20332-1","SUSE-SU-2025:20361-1","openSUSE-SU-2025:15222-1","openSUSE-SU-2025:15697-1"],"database_specific":{"cwe_ids":["CWE-426"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4802.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.27"},{"fixed":"2.39"}]}],"cna_assigner":"glibc"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/16/7"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/17/2"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html"},{"type":"WEB","url":"https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4802.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4802"},{"type":"REPORT","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=32976"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bminor/glibc","events":[{"introduced":"23158b08a0908f381459f273a984c6fd328363cb"},{"last_affected":"36f2487f13e3540be9ee0fb51876b1da72176d3f"}],"database_specific":{"cpe":"cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.27"},{"last_affected":"2.38"}],"source":"CPE_RANGE"}}],"versions":["glibc-2.38","glibc-2.37","glibc-2.37.9000","glibc-2.36","glibc-2.36.9000","glibc-2.35","glibc-2.35.9000","glibc-2.34","glibc-2.34.9000","glibc-2.33","glibc-2.33.9000","glibc-2.32","glibc-2.32.9000","glibc-2.31","glibc-2.31.9000","changelog-ends-here","glibc-2.30","glibc-2.30.9000","glibc-2.29","glibc-2.29.9000","glibc-2.28","glibc-2.28.9000","glibc-2.27","glibc-2.27.9000"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4802.json"}},{"ranges":[{"type":"GIT","repo":"https://sourceware.org/git/glibc.git","events":[{"introduced":"23158b08a0908f381459f273a984c6fd328363cb"},{"last_affected":"36f2487f13e3540be9ee0fb51876b1da72176d3f"}],"database_specific":{"cpe":"cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.27"},{"last_affected":"2.38"}],"source":"CPE_RANGE"}}],"versions":["glibc-2.38","glibc-2.37","glibc-2.37.9000","glibc-2.36","glibc-2.36.9000","glibc-2.35","glibc-2.35.9000","glibc-2.34","glibc-2.34.9000","glibc-2.33","glibc-2.33.9000","glibc-2.32","glibc-2.32.9000","glibc-2.31","glibc-2.31.9000","changelog-ends-here","glibc-2.30","glibc-2.30.9000","glibc-2.29","glibc-2.29.9000","glibc-2.28","glibc-2.28.9000","glibc-2.27","glibc-2.27.9000"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4802.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}