CVE-2026-6238 Buffer overread in ns_printrrf with corrupted RDATA field
An attacker can cause a crash or read uninitialized memory in applications using deprecated glibc DNS debugging functions via a crafted DNS response.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6238?
CVE-2026-6238 is a medium-severity memory corruption vulnerability in Gnu Glibc, published on 28 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.
These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
Weakness: CWE-126
Which versions are affected by CVE-2026-6238?
It affects 1 product.
Products include Gnu Glibc.
How do I fix CVE-2026-6238?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-6238 being exploited?
There is no known exploitation of CVE-2026-6238 in the wild and no public exploit code.
Other vulnerabilities in Gnu Glibc
Sources
Also known as AZL-85004, BELL-CVE-2026-6238, CLSA-2026-1780916496, DEBIAN-CVE-2026-6238, ECHO-916f-8705-1b52, GHSA-h8wx-jcwq-g3cp and 7 more.