2.1Low

CVE-2026-6368wordexp with WRDE_APPEND can return or use invalid memory

glibc glibc Published: 2026-08-10 21:40 (3 months ago)

Description

Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

Weakness (CWE): CWE-908

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
glibc	glibc	1.93-260 – < 2.43

References and patches

https://sourceware.org/bugzilla/show_bug.cgi?id=34090 issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04… vendor-advisory

CVSS score

2.1Low

Source: glibc · CVSS 4.0

Attack vector: Local
Attack complexity: High
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality: Low
Integrity: Low
Availability: Low
Scope: P

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:P/AU:Y/U:Green

All scores (2)

cna	CVSS 4.0	2.1Low
3ff69d7a-14f2-4f67-a097-88dee7810d18	CVSS 4.0	2.1Low

EPSS (chance of exploitation in 30 days)

0.11%

higher than 1% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-04-15
Published2026-08-10 21:40
Reached IP-DB2026-10-24 23:43
Last updated2026-09-03 19:43

Assigned by (CNA): glibc
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — GNU C Library (glibc)

3.7Low

CVE-2026-100290 3 days ago

Double free after allocation failure in regcomp and regexec

The GNU C Library glibc

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node ta…

4.8Medium

CVE-2026-115819 3 days ago

One-byte buffer overflow in wide scanf %s and %[ conversions

The GNU C Library glibc

Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the…

5.9Medium

CVE-2026-122054 10 days ago

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

7.0High

CVE-2026-84243 15 days ago

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

3.7Low

CVE-2026-97399 1 month ago

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Low

CVE-2026-95818 1 month ago

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…