Skip to content
fr Sign in
6.6 Medium

CVE-2026-6791 When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts…

Description

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

Affected products and versions

Product Affected versions Fixed in
glibc 2.0 2.0 → 2.43 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of glibc

The 35 CVEs of glibc →
CVE-2026-122054 BIG-HKSCS decoding hang on crafted input 5.9 Medium CVE-2026-84243 The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable… 7.0 High CVE-2026-97399 The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte… 3.7 Low CVE-2026-95818 A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44… 3.6 Low
Track this CVE