Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-0687

CVE-2023-0687CRITICAL

GNU C Library — A vulnerability was found in GNU C Library 2.38.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0109   64.9     —

AFFECTED
  Product    Versions  Fixed
  C Library  2.38 –    —

TIMELINE
  Feb 6   Reserved by VulDB
  Feb 6   Published (CNA: VulDB)
  Oct 14  RESCORED — CVE-2023-0687 (GNU C Library). CVSS 4.6 → 9.8 (NVD).

CWE-120 · CNA: VulDB · CVSS v3.1 · 5 references · NVD status: Modified

Description

A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
February 6, 2023	Reserved	Reserved by VulDB
February 6, 2023	Published	Published (CNA: VulDB)
October 14, 2026	RESCORED	RESCORED — CVE-2023-0687 (GNU C Library). CVSS 4.6 → 9.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
GNU	C Library	—	2.38	—

Weaknesses

CWE-120

References (5)

https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://patchwork.sourceware.org/project/glibc/patch/20230204114138.5436-1-leo%40yuriev.ru/ [Patch]
https://sourceware.org/bugzilla/show_bug.cgi?id=29444 [Issue Tracking, Patch, Third Party Advisory]
https://vuldb.com/?ctiid.220246 [Permissions Required, Third Party Advisory]
https://vuldb.com/?id.220246 [Permissions Required, Third Party Advisory]

Authoritative record: CVE-2023-0687 at cve.org

Vendors: gnu

Weaknesses: CWE-120

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-0687 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.