GNU C Library CVE-2026-6368

Exploitation requires a local process - running under any user privilege level, including unprivileged - to call wordexp() with the WRDE_APPEND flag in a sequence that produces the invalid we_wordv memory condition, followed by a call to wordfree() on the resulting corrupt structure. The AT:P metric confirms the specific precondition: the target application must actually invoke wordexp with WRDE_APPEND, which is an uncommon usage confined to applications performing iterative or appending shell-style word expansion. Exploitation is strictly limited to the local system (AV:L) with no network exposure path. The high complexity rating (AC:H) reflects that the caller must trigger the specific internal state in the wordexp implementation that yields the invalid pointer. No authentication to the system or to any specific application service is implied as a distinct barrier, but local code execution is the minimum requirement. Remote exploitation is not applicable.

Real-world risk is low despite glibc's pervasive deployment. The CVSS 4.0 score of 2.1 accurately captures the key constraints: AV:L requires local code execution on the affected system, AC:H reflects the specific WRDE_APPEND invocation pattern that must be present, and AT:P confirms a precondition - an application must actually exercise this uncommon API flag in a way that triggers the invalid memory return. Even a mid-sized municipal IT team in malbork would be unlikely to encounter active targeting of this specific API behavior, given there is no known public exploit and no CISA KEV listing. The supplemental CVSS 4.0 metric AU:Y (Automatable: Yes) is worth scrutinizing alongside AC:H and AT:P; the most plausible interpretation is that once a target application using the vulnerable code path is identified, the trigger mechanism - a crafted input leading to a WRDE_APPEND call - can be reliably automated, even if the precondition itself is narrow. The Safety supplemental metric S:P warrants additional consideration for glibc deployments in safety-critical embedded, industrial control, or medical environments where an unexpected process abort may have physical consequences. Overall, this is a low-urgency defect limited to specific API usage, not a broad exploitation surface.

A local user or process influences an application - such as a shell utility, scripting tool, or service performing iterative shell-style expansion - to call wordexp() with WRDE_APPEND in an error-handling or accumulation loop. The library returns an invalid we_wordv pointer into the wordexp_t structure. When the application calls wordfree() during cleanup, the heap allocator detects the corrupt pointer and aborts the process, rendering the application unavailable. No public exploit code has been identified at time of analysis.