CVE-2026-38638

A denial-of-service vulnerability exists in the with_argv function (unistd/mod.rs) of relibc, the Rust-based C library developed for the Redox OS project, at commit 61f42d. An attacker able to feed crafted input through the affected argument-processing path can trigger uncontrolled resource consumption (CWE-400), making the targeted process or system unavailable. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network-reachable exploitation with no privileges or user interaction required, and impact is limited to availability. Users of relibc at or around commit 61f42d are affected, which in practice means Redox OS deployments and any projects embedding this libc. No public proof-of-concept is known, the issue is not in CISA KEV, and the 0.4% EPSS score suggests a low near-term probability of exploitation.

What to do: Track the relibc/Redox OS repository for a fix commit superseding 61f42d and update to the patched commit once published, since no fixed version number is available in the current data. Operators running Redox OS or anything embedding relibc should identify builds pinned near commit 61f42d and limit exposure of untrusted input to processes using this libc. Given the absence of a public PoC, absence from KEV, and low EPSS, treat this as lower-priority hardening rather than an emergency patch.