CVE-2026-6368: wordexp with WRDE_APPEND can return or use invalid memory
Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process.
Other sources
wordexp with WRDEAPPEND can return or use invalid memory
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.43-5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6368?
CVE-2026-6368 is rated with a risk score of 23, indicating a significant vulnerability.
How do I fix CVE-2026-6368?
To fix CVE-2026-6368, upgrade to a patched version of the GNU C Library that addresses this issue.
What systems are affected by CVE-2026-6368?
CVE-2026-6368 affects versions of the GNU C Library from 2.0 to 2.43.
What happens if I do not address CVE-2026-6368?
If CVE-2026-6368 is not addressed, it may lead to process aborts when using the wordfree function.
Is CVE-2026-6368 a memory-related vulnerability?
Yes, CVE-2026-6368 involves returning or using invalid memory when calling wordexp with WRDE_APPEND.