CVE-2005-3590: The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argum...

Security readout for executives and security teams

CVE-2005-3590 is an old GNU C library flaw where a specific getgrouplist call can write into memory even when the provided group array size is zero. In affected glibc versions before 2.3.5, this could corrupt memory. Business urgency is mainly for legacy systems or vendor appliances still carrying very old libc builds. Likely exposure is limited to legacy Linux systems, embedded products, or appliances using glibc earlier than 2.3.5. Modern supported distributions are unlikely to be affected, but vendor-maintained appliances should be verified against their advisories. Treat this as a legacy exposure cleanup item unless asset inventory shows critical systems running affected glibc. No source provided evidence of active exploitation, but core library memory corruption on unsupported systems deserves scheduled remediation. Mitigation focus: Upgrade or confirm glibc is version 2.3.5 or later.; Check vendor advisories for appliances using bundled glibc builds.; Prioritize unsupported legacy Linux and embedded systems for review..

Prepared

Jun 6, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.