CVE-2018-11236 is a critical integer overflow vulnerability in the GNU C Library (glibc) 2.27 and earlier, specifically in the realpath function, affecting products from vendors like GNU, NetApp, Oracle, and Red Hat. This vulnerability, with a CVSS score of 9.8, allows for a stack-based buffer overflow on 32-bit architectures when processing very long pathnames, potentially leading to arbitrary code execution. While highly severe and easily exploitable over a network with low complexity, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in the CISA KEV catalog. Furthermore, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.27CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | ||
4.0CPE matchmatch criteria | cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.