CVE-2010-3856: ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly...

Security readout for executives and security teams

CVE-2010-3856 is a local privilege-escalation flaw in glibc's dynamic linker. On affected systems, a local user could abuse LD_AUDIT handling during privileged program loads to gain higher privileges. It matters mainly for legacy Linux systems or appliances still running old glibc/libc6 builds. Exposure is most likely on obsolete Linux distributions, embedded appliances, or vendor products that bundled affected glibc versions. Modern supported distributions are less likely exposed if historical glibc advisories were applied. Treat this as high priority for legacy estate cleanup and appliance review. It is not described as remotely exploitable, but successful abuse could turn a low-privileged local account into privileged system control. Mitigation focus: Upgrade glibc/libc6 to vendor-fixed packages or supported distribution releases.; Verify glibc is at least 2.11.3 or 2.12.2 where those branches apply.; Review vendor advisories for appliances that bundle glibc, including VMware and Avaya references..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.