CVE-2026-6791

{
  "id": "CVE-2026-6791",
  "sourceIdentifier": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
  "published": "2026-08-10T19:17:30.877",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."
    },
    {
      "lang": "es",
      "value": "Al expandir rutas que comienzan con una tilde (~) seguida de un nombre de usuario, la función interna parse_tilde extrae el nombre de usuario para determinar el directorio de inicio del usuario. La implementación asigna memoria para este nombre de usuario directamente en la pila utilizando la macro strndupa. Debido a que el tamaño de esta asignación se determinó por la longitud de la entrada proporcionada por el usuario sin ninguna comprobación de límites, pasar un nombre de usuario excesivamente largo, por ejemplo, miles de caracteres, obliga al hilo a agotar su espacio de pila. Así, si una aplicación pasa entrada no confiable, controlada por el atacante, a la función wordexp, un atacante puede desencadenar un ’stack clash’."
    }
  ],
  "affected": [
    {
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
      "affectedData": [
        {
          "vendor": "The GNU C Library",
          "product": "glibc",
          "defaultStatus": "unaffected",
          "collectionURL": "https://sourceware.org/glibc/",
          "packageName": "glibc",
          "platforms": [
            "Linux"
          ],
          "repo": "https://sourceware.org/git/?p=glibc.git",
          "versions": [
            {
              "version": "2.0",
              "lessThanOrEqual": "2.43",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "UNREPORTED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T18:01:21.626992Z",
          "id": "CVE-2026-6791",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34091",
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
    }
  ]
}