Skip to main content

GNU C Library EUVDEUVD-2026-55729

| CVE-2026-6791 MEDIUM
Stack-based Buffer Overflow (CWE-121)
2026-08-10 glibc GHSA-ch73-g8qv-r6r5
Buffer Overflow Stack Overflow Glibc The Gnu C Library
6.6
CVSS 4.0 · Vendor: glibc
Share

Severity by source

Vendor (glibc) PRIMARY
6.6 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

AV:N because input reaches glibc via networked applications; AC:H because wordexp() must be called on attacker input; S:C captures downstream application and service availability impact beyond the library itself.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (glibc).

CVSS VectorVendor: glibc

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 19:33 vuln.today
CVE Published
Aug 10, 2026 - 18:41 cve.org
MEDIUM 6.6

DescriptionCVE.org

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

AnalysisAI

Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.

Technical ContextAI

GNU C Library (glibc), identified by CPE cpe:2.3:a:the_gnu_c_library:glibc:*:*:*:*:*:*:*:*, provides the wordexp() POSIX function for performing word expansion including tilde substitution. The internal parse_tilde function handles paths beginning with '~username' by extracting the username string to call getpwnam() for home directory resolution. The vulnerable code uses the strndupa() GNU extension macro, which allocates variable-length memory on the calling thread's stack via alloca semantics - unlike malloc, there is no heap boundary, just the fixed stack frame. CWE-121 (Stack-based Buffer Overflow) precisely describes the root cause: user-supplied length dictates stack frame growth with no upper bound enforced, enabling a stack clash where the stack collides with adjacent memory regions, leading to availability loss and, under specific conditions, limited integrity or confidentiality impact as reflected in the CVSS 4.0 vector (VC:L/VI:L/VA:H).

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis; the upstream fix status should be monitored via the glibc Bugzilla entry at https://sourceware.org/bugzilla/show_bug.cgi?id=34091 and downstream distribution security advisories. Once a patched glibc version is released, upgrade via the distribution package manager and restart affected services. As an immediate compensating control, audit all application code for calls to wordexp() that accept user-supplied strings and introduce explicit length validation or rejection of tilde-prefixed inputs exceeding a safe threshold (e.g., reject any username component longer than LOGIN_NAME_MAX, typically 256 bytes on Linux). Alternatively, replace wordexp() with a safer alternative such as glob() or manual path construction that does not perform tilde expansion. Disabling wordexp()-based features in applications where tilde expansion is not required eliminates the attack surface entirely with no functional impact on non-tilde paths. Note that stripping or refusing the '~' character at application input boundaries is the highest-confidence workaround.

More in Glibc

View all
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2024-2961 HIGH POC
7.3 Apr 17

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
CVE-2015-7547 HIGH POC
8.1 Feb 18

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
CVE-2023-6246 HIGH POC
8.4 Jan 31

Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
CVE-2014-5119 HIGH POC
7.5 Aug 29

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
CVE-2012-4412 HIGH POC
7.5 Oct 09

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
CVE-2018-1000001 HIGH POC
7.8 Jan 31

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
CVE-2023-25139 CRITICAL POC
9.8 Feb 03

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct

CVE-2021-33574 CRITICAL POC
9.8 May 25

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
CVE-2019-1010022 CRITICAL POC
9.8 Jul 15

GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2019-9169 CRITICAL POC
9.8 Feb 26

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

EUVD-2026-55729 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy