Potential stack-based buffer clash during tilde expansion in wordexp
Published Aug 10, 2026
6.6
MEDIUMCVSS 4.0
EPSS 0.33%
Description
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Affected products
-
Affected
- ≥ 2.0, ≤ 2.43
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| The GNU C Library | Glibc | unaffected | Affected
|
No data.
No data.
Red Hat Hardened Images
glibc-main-2.43-8.1.hum1
Fixed · RHSA-2026:53069
Red Hat Enterprise Linux 10
glibc
Fix deferred
Red Hat Enterprise Linux 6
compat-glibc
Out of support scope
Red Hat Enterprise Linux 6
glibc
Out of support scope
Red Hat Enterprise Linux 7
compat-glibc
Fix deferred
Red Hat Enterprise Linux 7
glibc
Fix deferred
Red Hat Enterprise Linux 8
glibc
Fix deferred
Red Hat Enterprise Linux 9
glibc
Affected
Red Hat Hardened Images
filesystem
Not affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-9
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | glibc-main-2.43-8.1.hum1 | Fixed | RHSA-2026:53069 |
| Red Hat Enterprise Linux 10 | glibc | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | compat-glibc | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | glibc | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | compat-glibc | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | glibc | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | glibc | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | glibc | Affected | n/a |
| Red Hat Hardened Images | filesystem | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://access.redhat.com/security/cve/CVE-2026-6791 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2513603 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55729 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6791
- https://sourceware.org/bugzilla/show_bug.cgi?id=34091 issue-tracking
- https://www.cve.org/CVERecord?id=CVE-2026-6791
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub
No data