CVE Catalog
CVE-2026-6368
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk0.11%
1th percentile - higher than 1% of all known CVEs
Summary
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
Risk Assessment
The vulnerability can lead to process crashes (denial of service) in applications using wordexp with WRDE_APPEND. This may disrupt services relying on this function.
Recommendation
It is recommended to upgrade glibc to version 2.44 or later, which fixes the invalid memory issue.
Original NVD description (English source)
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.