# CVE-2026-89092

## Summary

- **CVE ID:** CVE-2026-89092
- **Severity:** MEDIUM
- **CVSS Score:** 4.2 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **CWE:** CWE-789
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 11, 2026

## Description

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a 
stack overflow when a malicious DNS server returns too large a response 
for a DNS query, resulting in degraded DNS resolution for the system.



Exploitation of this bug needs a system that has nscd enabled and using 
an untrusted DNS server for name resolution, with the compromised DNS 
server being capable of processing records large enough to result in a 
stack overflow in an nscd thread stack.  During experimentation, bind 9 
was unable to handle large records, but that could change in future or 
with a different name server.  In typical installations, nscd is 
executed in an isolated context as its own user without a shell, due to 
which any compromise of that service is isolated.



There is a remote possibility of nscd cache corruption if an attacker 
manages to get the stack pointer into a desired point in the heap, 
potentially resulting in other caches in nscd being overwritten with 
corrupt data through the stack overflow, until the buggy code path 
eventually results in a crash.



Finally, a crash in nscd may result in performance degradation when 
resolving names, but it does not result in a denial of service.

## Affected Products

- The GNU C Library — glibc (2.3.4)

## References

- [CNA](https://sourceware.org/bugzilla/show_bug.cgi?id=34624)
- [CNA](https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016)
- [CVE](http://www.openwall.com/lists/oss-security/2026/09/11/2)

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._