“The bug is due to a heap-based buffer overflow weakness accidentally introduced in glibc 2.37 in August 2022 and later backported to glibc 2.36 when addressing a less severe vulnerability tracked as CVE-2022-39046.”
CVE-2023-6246 sits in the code that writes to syslog, and any unprivileged user can ride it to root on default Debian 12, Ubuntu 23.10 and Fedora 39 installs. The hole came from a patch for a smaller bug, then got backported along with the fix. Qualys found three more flaws while it was in there. The last Qualys glibc bug, Looney Tunables, was in active attacks within a month.