CVE-2026-6791

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

CVSS

No CVSS.

References

Link	Resource
https://sourceware.org/bugzilla/show_bug.cgi?id=34091

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Al expandir rutas que comienzan con una tilde (~) seguida de un nombre de usuario, la función interna parse_tilde extrae el nombre de usuario para determinar el directorio de inicio del usuario. La implementación asigna memoria para este nombre de usuario directamente en la pila utilizando la macro strndupa. Debido a que el tamaño de esta asignación se determinó por la longitud de la entrada proporcionada por el usuario sin ninguna comprobación de límites, pasar un nombre de usuario excesivamente largo, por ejemplo, miles de caracteres, obliga al hilo a agotar su espacio de pila. Así, si una aplicación pasa entrada no confiable, controlada por el atacante, a la función wordexp, un atacante puede desencadenar un ’stack clash’.

Information

Published : 2026-08-10 19:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-6791

Mitre link : CVE-2026-6791

CVE.ORG link : CVE-2026-6791

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-6791", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6791", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T18:01:21.626992Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "affectedData": [{"repo": "https://sourceware.org/git/?p=glibc.git", "vendor": "The GNU C Library", "product": "glibc", "versions": [{"status": "affected", "version": "2.0", "versionType": "custom", "lessThanOrEqual": "2.43"}], "platforms": ["Linux"], "packageName": "glibc", "collectionURL": "https://sourceware.org/glibc/", "defaultStatus": "unaffected"}]}], "published": "2026-08-10T19:17:30.877", "references": [{"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34091", "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}, {"lang": "es", "value": "Al expandir rutas que comienzan con una tilde (~) seguida de un nombre de usuario, la funci\u00f3n interna parse_tilde extrae el nombre de usuario para determinar el directorio de inicio del usuario. La implementaci\u00f3n asigna memoria para este nombre de usuario directamente en la pila utilizando la macro strndupa. Debido a que el tama\u00f1o de esta asignaci\u00f3n se determin\u00f3 por la longitud de la entrada proporcionada por el usuario sin ninguna comprobaci\u00f3n de l\u00edmites, pasar un nombre de usuario excesivamente largo, por ejemplo, miles de caracteres, obliga al hilo a agotar su espacio de pila. As\u00ed, si una aplicaci\u00f3n pasa entrada no confiable, controlada por el atacante, a la funci\u00f3n wordexp, un atacante puede desencadenar un \u2019stack clash\u2019."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "3ff69d7a-14f2-4f67-a097-88dee7810d18"}