CVE-2026-6791
Last modified
CVE-2026-6791 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro.
Description
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Metrics
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| The GNU C Library | glibc | >= 2.0, <= 2.43 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-6791?
How severe is CVE-2026-6791?
How do I fix CVE-2026-6791?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-67870In open62541 v1.5.5, the server-side AddReferences implement…9.8
- CVE-2026-67871Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows…7.5
- CVE-2026-67872An issue in Systerel S2OPC 1.7.3 allows a remote attacker to…7.5
- CVE-2026-67873A heap-based buffer overflow exists in lib60870-C 2.4.0 in t…9.8
- CVE-2026-6788Uncontrolled Search Path Element vulnerability in WatchGuard…7.8
- CVE-2026-6790In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, th…5.3
- CVE-2026-6792Missing Authorization vulnerability in Universal Software In…6.5
- CVE-2026-6793Improper neutralization of input during web page generation …5.4
- CVE-2026-6795URL redirection to untrusted site ('open redirect') vulnerab…9.6
- CVE-2026-6796A vulnerability was determined in Sanluan PublicCMS up to 6.…5.3
- CVE-2026-67969An issue in the HS_MonitorApplications() component of NASA c…7.5
- CVE-2026-6797A vulnerability was identified in Sanluan PublicCMS up to 6.…5.3
Are you affected by CVE-2026-6791?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST