CoreCVE
Back

HIGH

glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH

Published May 16, 2025

Description

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

Affected products

Remediation

Red Hat statement

This issue can only be exploitable by a local attacker via a static setuid program that calls the dlopen function, causing the library to search LD_LIBRARY_PATH to locate the shared object name to load. No such programs have been found in Red Hat Enterprise Linux at the time of publishing this advisory. However, custom setuid programs, although strongly discouraged as a security practice, may exist and can not be discarded. Due to these reasons, this flaw has been rated with a moderate severity.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (1)

CWE-426

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner glibc
Published May 16, 2025
Updated Feb 26, 2026
Reserved May 15, 2025
Link CVE-2025-4802
CISA Vulnrichment
Updated May 20, 2025
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2025-4802
Red Hat
Severity Moderate
Public date May 16, 2025
Links CVE-2025-4802 - Bugzilla