glibc wordexp Stack Clash via Large Tilde Username
CVE-2026-6791 Published on August 10, 2026
Potential stack-based buffer clash during tilde expansion in wordexp
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Vulnerability Analysis
CVE-2026-6791 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-6791 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-6791
Want to know whenever a new CVE is published for GNU Glibc? stack.watch will email you.
Affected Versions
The GNU C Library glibc:- Version 2.0, <= 2.43 is affected.