CVE-2026-6791
Received Received - Intake

Stack Clash in wordexp via Tilde Expansion

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GNU C Library

Description
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-6791
EUVD
EUVD-2026-55729

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a stack-based memory allocation issue in the parse_tilde function. When processing paths starting with a tilde (~), the function extracts a username to determine the home directory. It allocates memory on the stack using the username length without bounds checks. Attackers can exploit this by providing an extremely long username, causing the thread to exhaust its stack space and trigger a stack clash.

Detection Guidance

This vulnerability can be detected by monitoring for applications that use the wordexp function with untrusted input. Check for stack exhaustion errors or crashes in applications handling long tilde paths. No specific commands are provided in the context.

Impact Analysis

If an application uses the vulnerable function with untrusted input, an attacker could crash the application or execute arbitrary code by causing a stack overflow. This may lead to denial-of-service conditions or potential compromise of the affected system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through stack exhaustion, which may disrupt services handling sensitive personal or health data. Unauthorized disruption could lead to violations of availability requirements under these regulations.

Mitigation Strategies

Immediately update or patch applications using wordexp to ensure proper bounds checking. Avoid passing untrusted input to wordexp. Monitor for unusual stack usage or crashes in affected applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart