CVE-2026-6368: wordexp with WRDE_APPEND can return or use invalid memory
Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU C Library (glibc)to a version that resolves this vulnerability.Fixed in 2.43 - Compensating control
Avoid using wordexp with the WRDE_APPEND flag in systems using GNU C Library versions affected by WRDE_APPEND-related invalid memory (2.0 to 2.43), until upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6368?
CVE-2026-6368 is rated with a risk score of 23, indicating a significant vulnerability.
How do I fix CVE-2026-6368?
To fix CVE-2026-6368, upgrade to a patched version of the GNU C Library that addresses this issue.
What systems are affected by CVE-2026-6368?
CVE-2026-6368 affects versions of the GNU C Library from 2.0 to 2.43.
What happens if I do not address CVE-2026-6368?
If CVE-2026-6368 is not addressed, it may lead to process aborts when using the wordfree function.
Is CVE-2026-6368 a memory-related vulnerability?
Yes, CVE-2026-6368 involves returning or using invalid memory when calling wordexp with WRDE_APPEND.