Critical vulnerabilities identified in glibc and Ray framework

Two significant cybersecurity vulnerabilities have been identified in widely used software components.

In the GNU C Library (glibc), a vulnerability known as CVE-2023-4911, or ‘Looney Tunables’, affects the dynamic linker/loader (ld.so). The flaw resides in the parse_tunables function, where a malformed GLIBC_TUNABLES environment variable can trigger an out-of-bounds memory write when passed to an SUID binary. This could allow for unauthorized system access through common programs like ‘su’.

Separately, a critical remote code execution (RCE) vulnerability, CVE-2025-62593, has been discovered in Ray, a distributed computing framework used for Python and machine-learning workloads. The flaw utilizes DNS rebinding to bypass browser-based protections, allowing an attacker-controlled webpage to access the Ray Dashboard and execute arbitrary commands via the Jobs API. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, noting active exploitation. Users are advised to upgrade to Ray version 2.52.0 or later.