EUVD-2026-55727
GHSA-cm6j-gmqf-j2cm
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Green
Local attack vector with high complexity due to specific WRDE_APPEND call pattern precondition; no privileges required; scope unchanged as impact is confined to the calling process.
Primary rating from Vendor (glibc).
CVSS VectorVendor: glibc
Lifecycle Timeline
3DescriptionCVE.org
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
AnalysisAI
Uninitialized memory exposure in GNU C Library (glibc) versions 2.0 through 2.43 corrupts the we_wordv member of the wordexp_t structure when wordexp is called with the WRDE_APPEND flag under specific conditions, causing a subsequent wordfree call to abort the calling process. Disclosed by the glibc project as GLIBC-SA-2026-0014 and rooted in CWE-908 (Use of Uninitialized Resource), the flaw carries a CVSS 4.0 base score of 2.1, reflecting meaningful exploitation constraints including a local attack vector and high complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The wordexp() POSIX function in glibc performs shell-style word expansion - pathname globbing, variable substitution, and command substitution - and populates a wordexp_t structure whose we_wordv member holds the resulting word vector array. The WRDE_APPEND flag is designed to extend a previously populated word vector across multiple wordexp calls. CWE-908 (Use of Uninitialized Resource) indicates that internal bookkeeping for we_wordv is incorrectly handled under the WRDE_APPEND code path, causing the function to return a pointer to invalid or uninitialized memory in we_wordv. When the caller subsequently passes this structure to wordfree(), the C heap allocator detects the corrupt pointer and aborts the process via an assertion failure or allocator integrity check. The affected CPE is cpe:2.3:a:glibc:glibc:*:*:*:*:*:*:*:*, spanning glibc versions 2.0 through 2.43 - a range covering over two decades of releases and the overwhelming majority of Linux userland deployments. The bug is documented in the upstream Bugzilla at https://sourceware.org/bugzilla/show_bug.cgi?id=34090.
RemediationAI
The primary remediation is to upgrade to a glibc release beyond version 2.43 once the glibc project publishes a patched version; however, a specific fixed release version is not confirmed in the available data - patch availability should be tracked directly against the upstream advisory at https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014 and the associated Bugzilla report at https://sourceware.org/bugzilla/show_bug.cgi?id=34090. As an interim compensating control, development and security teams should audit application codebases for any use of wordexp() with the WRDE_APPEND flag and refactor those call sites to use a fresh wordexp_t structure per invocation rather than appending, which eliminates the vulnerable code path at the application level without requiring a library update. System administrators should prioritize local access restriction on hosts running applications known to use this API pattern. No network-level mitigation is applicable given the local attack vector.
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today