CVE-2026-6368
Received Received - Intake

GNU C Library wordexp WRDE_APPEND Memory Corruption

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GNU C Library

Description
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-6368
EUVD
EUVD-2026-55727

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu gnu_c_library to 2.43 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the GNU C Library's wordexp function when used with the WRDE_APPEND flag. It can return invalid memory in the we_wordv member, which may cause the program to abort when wordfree is called later.

Detection Guidance

This vulnerability is specific to the GNU C Library and requires checking the library version. Use 'ldd --version' or 'libc.so.6' to verify if your system uses a vulnerable version (2.0 to 2.43).

Impact Analysis

This vulnerability could cause applications using wordexp with WRDE_APPEND to crash unexpectedly, potentially leading to denial of service or data corruption in affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory corruption issue in the GNU C Library that could lead to process termination but does not inherently involve data breaches or unauthorized access.

Mitigation Strategies

Update the GNU C Library to a version beyond 2.43. If updating is not immediately possible, avoid using wordexp with WRDE_APPEND flag in applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart