CVE-2026-6368: wordexp with WRDE_APPEND can return or use invalid memory

Severity: low (CVSS 2.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-09-03
Weakness: CWE-908

Description

Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

Affected products

glibc: from 1.93-260 before 2.43 — fixed in 2.43

How to fix

Upgrade to a fixed version: glibc 2.43. Check the vendor advisory for mitigations.

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34090
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD

Get alerted when CVE-2026-6368 or the next vulnerability affects your stack