CVE-2025-4802
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4802?
CVE-2025-4802 is considered a high severity vulnerability due to its potential to allow arbitrary code execution in setuid binaries.
How do I fix CVE-2025-4802?
To fix CVE-2025-4802, update the GNU C Library to a version later than 2.38.
Who is affected by CVE-2025-4802?
CVE-2025-4802 affects users of the GNU C Library versions between 2.27 and 2.38 that utilize setuid binaries.
What type of vulnerability is CVE-2025-4802?
CVE-2025-4802 is an untrusted LD_LIBRARY_PATH environment variable vulnerability.
What can an attacker do with CVE-2025-4802?
An attacker exploiting CVE-2025-4802 can control the loading of dynamically shared libraries in vulnerable applications, potentially leading to full system compromise.