Is CVE-2017-1000366 being actively exploited?

CVE-2017-1000366 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2017-1000366?

CVE-2017-1000366 has a CVSS 3.0 base score of 7.8 (HIGH).

CVE-2017-1000366

HIGH · CVSS 7.8EPSS 2.7%EU EUVD

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Key facts

CVSS score: 7.8 (v3.0)
Severity: HIGH
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-119
EPSS score: 2.7% (86th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2017-1525)
Published: June 19, 2017
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2017-1525 in the EU Vulnerability Database. Last updated in EUVD on August 5, 2024.

View on the EU Vulnerability Database

Affected products

debian / debian linux
debian / debian linux
gnu / glibc
mcafee / web gateway
novell / suse linux enterprise desktop
novell / suse linux enterprise point of sale
novell / suse linux enterprise server
openstack / cloud magnum orchestration
opensuse / leap
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server long life
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux workstation
redhat / enterprise linux workstation
suse / linux enterprise for sap
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server
suse / linux enterprise server for raspberry pi
suse / linux enterprise software development kit

and 1 more…

Certified products that may be affected

6 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 7.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11039-2020 - archived
SUSE Linux Enterprise Server 12 SP2 - NSS Cryptographic Module - SUSE, LLC - FIPS 140 3216 - historical
SUSE Linux Enterprise Server 11 Service Pack 2 on IBM System z - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0852-2013 - archived
SUSE Linux Enterprise Server 11 Service Pack 2 including KVM virtualization - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0787-2013 - archived
McAfee® Web Gateway Version 7.2.0.1 - McAfee, Inc. - Common Criteria 383-4-215 - archived

See all 6 in the Security Certifications Explorer.

References

http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
http://seclists.org/fulldisclosure/2019/Sep/7
http://www.debian.org/security/2017/dsa-3887(Third Party Advisory)
http://www.securityfocus.com/bid/99127(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1038712(Third Party Advisory, VDB Entry)
https://access.redhat.com/errata/RHSA-2017:1479(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2017:1480(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2017:1481(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2017:1567(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2017:1712(Third Party Advisory)
https://access.redhat.com/security/cve/CVE-2017-1000366(Third Party Advisory)
https://kc.mcafee.com/corporate/index?page=content&id=SB10205(Patch, Third Party Advisory)
https://seclists.org/bugtraq/2019/Sep/7
https://security.gentoo.org/glsa/201706-19(Third Party Advisory)
https://www.exploit-db.com/exploits/42274/(Third Party Advisory, VDB Entry)
https://www.exploit-db.com/exploits/42275/(Third Party Advisory, VDB Entry)
https://www.exploit-db.com/exploits/42276/(Third Party Advisory, VDB Entry)
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt(Technical Description, Third Party Advisory)
https://www.suse.com/security/cve/CVE-2017-1000366/(Third Party Advisory)
https://www.suse.com/support/kb/doc/?id=7020973(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain