dash shell EUVD-2026-88667

Requires a dash binary built WITHOUT libc fnmatch (non-default; most distributions link libc fnmatch and are unaffected). The attacker must be a LOCAL user (AV:L) with the ability either to plant filenames in a directory that gets globbed or otherwise feed input to the internal pmatch() matcher (PR:L), and to cause a short multi-star pattern such as *.*.*.*.*.tar.gz to be matched. Limiting factors: no remote reachability, no privilege escalation or data disclosure, impact confined to CPU exhaustion of the affected shell process, and the vulnerable build option is not the norm on mainstream distributions.

All signals point to a low-priority availability issue despite the moderate 5.5 CVSS. The vendor vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent with the description: exploitation is LOCAL (AV:L), requires an existing low-privileged account or a foothold that lets the attacker plant filenames / feed the matcher (PR:L), and yields only a CPU-exhaustion denial of service (C:N/I:N/A:H). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept - so this is 'no public exploit identified at time of analysis.' The impact is bounded to CPU consumption of a shell process, not memory corruption or code execution, and it is only reachable in the non-default build configuration where dash is compiled WITHOUT libc fnmatch (most distributions link libc fnmatch, which is not affected). A notable data caveat: the CVSS AV:L/local framing is coherent with the description, but the sole CPE (Red Hat Enterprise Linux 6 only) is questionable because dash is the Debian/Ubuntu default /bin/sh and is not the default shell interpreter on RHEL - verify the true affected package/distros with the vendor.

A local unprivileged user on a system whose dash was built without libc fnmatch drops a file (or supplies input) into a location that a script later globs, then triggers a script using a multi-star glob such as *.*.*.*.*.tar.gz. The internal pmatch() matcher recurses unboundedly over candidate positions, pinning a CPU core and starving other work. No public exploit code is identified; the technique is trivial to reproduce given a vulnerable build.