CVE-2021-35942

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-22 · updated 2026-10-14
Weakness: CWE-190

Description

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Affected products

Debian Linux: 10.0
GNU C Library (glibc): before 2.31 — fixed in 2.31
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.70.1
NetApp Hci Management Node: all versions
NetApp ONTAP Select Deploy administration utility: all versions
NetApp Solidfire: all versions

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.31. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-35942 or the next vulnerability affects your stack