REDHAT-BUG-2513608: Medium severity GNU GNU C Library vulnerability

Q: Which applications are affected?

Applications using GNU C Library versions 2.0 through 2.43 may be affected if they call wordexp with the WRDE_APPEND flag and later call wordfree on the resulting wordexp_t data.

Q: What would an attacker need to trigger the issue?

An attacker would need a way to cause an application to follow the affected wordexp usage pattern: invoking wordexp with WRDE_APPEND and subsequently invoking wordfree. The reported outcome is that wordfree may abort the process.

Q: How can I determine whether my environment is exposed?

Identify systems running GNU C Library versions 2.0 through 2.43, then review applications for calls to wordexp that use WRDE_APPEND and are followed by wordfree. The issue concerns invalid memory returned through the we_wordv member.

Published Aug 10, 2026

Updated

Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process.

Affected Software

1 affected component

GNU GNU C Library>=2.0<=2.43

Event History

Aug 10, 2026

Data Sourced

via Red Hat·07:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are affected?

Applications using GNU C Library versions 2.0 through 2.43 may be affected if they call wordexp with the WRDE_APPEND flag and later call wordfree on the resulting wordexp_t data.

What would an attacker need to trigger the issue?

An attacker would need a way to cause an application to follow the affected wordexp usage pattern: invoking wordexp with WRDE_APPEND and subsequently invoking wordfree. The reported outcome is that wordfree may abort the process.

How can I determine whether my environment is exposed?

Identify systems running GNU C Library versions 2.0 through 2.43, then review applications for calls to wordexp that use WRDE_APPEND and are followed by wordfree. The issue concerns invalid memory returned through the we_wordv member.