CVE-2025-15281
published 2026-01-20CVE-2025-15281: Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return…
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.42-11 (forky) | glibc 2.42-11 (forky) |
| gnu | glibc | >= 0 < 2.41-12+deb13u2 | 2.41-12+deb13u2 |
| gnu | glibc | >= 0 < 2.42-11 | 2.42-11 |
| gnu | glibc | >= 0 < 2.35-0ubuntu3.13 | 2.35-0ubuntu3.13 |
| gnu | glibc | >= 0 < 2.39-0ubuntu8.7 | 2.39-0ubuntu8.7 |
| gnu | glibc | >= 0 < 2.42-0ubuntu3.1 | 2.42-0ubuntu3.1 |
| gnu | glibc | >= 0 < 2.23-0ubuntu11.3+esm9 | 2.23-0ubuntu11.3+esm9 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1.6+esm6 | 2.27-3ubuntu1.6+esm6 |
| gnu | glibc | >= 0 < 2.31-0ubuntu9.18+esm1 | 2.31-0ubuntu9.18+esm1 |
| gnu | glibc | >= 2.0 < 2.43 | 2.43 |
| the_gnu_c_library | glibc | 2.0 – 2.42 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH