CVE-2026-6791
published 2026-08-10CVE-2026-6791: When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home…
PriorityP338medium6.6CVSS 4.0
AVNACHATNPRNUINVCLVILVAHSCNSILSAHEUCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.22%
11.8th percentile
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| the_gnu_c_library | glibc | 2.0 – 2.43 | — |
| ubuntu | glibc | — | — |
CVSS provenance
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.6MEDIUM
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU glibc up to 2.43 parse_tilde wordexp stack-based overflow (Nessus ID 364488)
vuldb·2026-10-10·CVSS 6.6
CVE-2026-6791 [MEDIUM] GNU glibc up to 2.43 parse_tilde wordexp stack-based overflow (Nessus ID 364488)
A vulnerability classified as critical was found in GNU glibc up to 2.43. The impacted element is the function wordexp of the component parse_tilde. Executing a manipulation can lead to stack-based buffer overflow.
This vulnerability is handled as CVE-2026-6791. The attack can be executed remotely. There is not any exploit available.
GHSA
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.
ghsa_unreviewed·2026-08-10
CVE-2026-6791 [MEDIUM] CWE-121 When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 2.1
CVE-2026-77117 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides
the corresponding fixes for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that GNU C Library had a buffer overflow in the strfmon
function when handling right-justification padding. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)
It was discovered that GNU C Library had an out-of-bounds stack array
access in the tdelete function. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2026-19542)
It was discovered that GNU C Library incorrectly
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-09-08·CVSS 2.1
CVE-2026-77117 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that GNU C Library had a buffer overflow in the strfmon
function when handling right-justification padding. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)
It was discovered that GNU C Library had an out-of-bounds stack array
access in the tdelete function. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2026-19542)
It was discovered that GNU C Library incorrectly handled memory when
calling wordexp with the WRDE_APPEND flag. An attacker could possibly use
this issue to cause a denial of service. (CVE-2026-63
Red Hat
glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
vendor_redhat·2026-08-10·CVSS 6.6
CVE-2026-6791 [MEDIUM] CWE-120 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
A flaw was found in glibc. When processing paths that start with a tilde (~) followed by
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
bugzilla·2026-08-12·CVSS 6.6
CVE-2026-6791 [MEDIUM] CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the threa
Bugzilla
CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [epel-all]
bugzilla·2026-08-12·CVSS 6.6
CVE-2026-6791 [MEDIUM] CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [epel-all]
CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread
Bugzilla
CVE-2026-6791 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
bugzilla·2026-08-12·CVSS 6.6
CVE-2026-6791 [MEDIUM] CVE-2026-6791 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
CVE-2026-6791 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thr
Bugzilla
CVE-2026-6791 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
bugzilla·2026-08-10·CVSS 6.6
CVE-2026-6791 [MEDIUM] CVE-2026-6791 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
CVE-2026-6791 glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
2026-08-10
Published