medium 6.6

CVE-2026-6791 json

Potential stack-based buffer clash during tilde expansion in wordexp

published 2026-08-10 2 mo ago modified 2026-10-24 15 d ago also EUVD-2026-55729

cvss: 6.6; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

Patch / fix

fixed in 1 distros 7

gnu glibc 2.44

debian ubuntu red hat suse opensuse almalinux rocky linux

glibc Debian 14 2.43-3

debian advisories DEBIAN-CVE-2026-6791

glibc Ubuntu 22.04 LTS 2.35-0ubuntu3.15
glibc Ubuntu 24.04 LTS 2.39-0ubuntu8.9
glibc Ubuntu 26.04 LTS 2.43-2ubuntu2.4

ubuntu advisories UBUNTU-CVE-2026-6791

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

glibc RHEL 9 2.34-283.el9_8
nscd RHEL 9 2.34-283.el9_8
libnsl RHEL 9 2.34-283.el9_8
nss_db RHEL 9 2.34-283.el9_8
nss_hesiod RHEL 9 2.34-283.el9_8
glibc-utils RHEL 9 2.34-283.el9_8
glibc-common RHEL 9 2.34-283.el9_8
glibc-benchtests RHEL 9 2.34-283.el9_8

red hat advisories RHSA-2026:79281 RHSA-2026:76781 RHSA-2026:76777 RHSA-2026:53069

glibc SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 2.31-150300.109.1
glibc SLES 16.0, Linux Micro Extras 6.2, Linux Micro 6.2 +1 more 2.40-160000.7.1
glibc SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 +1 more 2.38-150600.14.58.1
glibc Linux Micro 6.1 2.38-slfo.1.1_10.1
glibc Linux Micro 6.0 2.38-15.1
glibc SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.22-114.52.2

suse advisories SUSE-SU-2026:4591-1 SUSE-SU-2026:23934-1 SUSE-SU-2026:23957-1 SUSE-SU-2026:23929-1 SUSE-SU-2026:4250-1 SUSE-SU-2026:4204-1

glibc openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-s390x-src openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-aarch64-src openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-ppc64le-src openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-riscv64-src openSUSE Leap 16.0 2.40-160000.7.1
glibc openSUSE Tumbleweed 2.44-1.1

opensuse advisories openSUSE-SU-2026:21968-1 openSUSE-SU-2026:11660-1

glibc AlmaLinux 9 2.34-283.el9_8
nscd AlmaLinux 9 2.34-283.el9_8
libnsl AlmaLinux 9 2.34-283.el9_8
nss_db AlmaLinux 9 2.34-283.el9_8
nss_hesiod AlmaLinux 9 2.34-283.el9_8
glibc-utils AlmaLinux 9 2.34-283.el9_8
glibc-common AlmaLinux 9 2.34-283.el9_8
glibc-benchtests AlmaLinux 9 2.34-283.el9_8

almalinux advisories ALSA-2026:79281 ALSA-2026:76777 ALSA-2026:76781

glibc Rocky Linux 10 2.39-142.el10_2
glibc Rocky Linux 9 2.34-283.el9_8
glibc Rocky Linux 8 2.28-251.el8_10.43

rocky linux advisories RLSA-2026:76781 RLSA-2026:79281 RLSA-2026:76777

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6791 updated 2026-11-06 cvss 5.9

glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion

Red Hat Enterprise Linux 6 nscd, glibc, glibc-utils, glibc-common, compat-glibc 2.5-46.2
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 nscd, glibc, glibc-utils, compat-glibc, glibc-common, compat-glibc 2.5-46.2 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
affected: no fix available “Fix deferred”
Red Hat Cost Management 4 costmanagement/costmanagement-metrics-rhel9-operator 1793202662
fixed: vendor fix RHSA-2026:95264
Red Hat Enterprise Linux AppStream (v. 8) glibc-utils 2.28-251.el8_10.43, compat-libpthread-nonshared 2.28-251.el8_10.43
fixed: vendor fix RHSA-2026:76777
Red Hat Enterprise Linux AppStream (v. 9) glibc-utils 2.34-283.el9_8, glibc-locale-source 2.34-283.el9_8
fixed: vendor fix RHSA-2026:79281
Red Hat Enterprise Linux AppStream (v. 10) glibc-utils 2.39-142.el10_2, glibc-locale-source 2.39-142.el10_2
fixed: vendor fix RHSA-2026:76781
Red Hat Enterprise Linux BaseOS (v. 8) nscd 2.28-251.el8_10.43, glibc 2.28-251.el8_10.43, libnsl 2.28-251.el8_10.43, nss_db 2.28-251.el8_10.43, glibc-common 2.28-251.el8_10.43, glibc-gconv-extra 2.28-251.el8_10.43, +3 more
fixed: vendor fix RHSA-2026:76777
Red Hat Enterprise Linux BaseOS (v. 9) nscd 2.34-283.el9_8, glibc 2.34-283.el9_8, libnsl 2.34-283.el9_8, glibc-common 2.34-283.el9_8, glibc-gconv-extra 2.34-283.el9_8, glibc-all-langpacks 2.34-283.el9_8, +1 more
fixed: vendor fix RHSA-2026:79281

show 7 more

Red Hat Enterprise Linux BaseOS (v. 10) glibc 2.39-142.el10_2, libnsl 2.39-142.el10_2, glibc-common 2.39-142.el10_2, glibc-gconv-extra 2.39-142.el10_2, glibc-all-langpacks 2.39-142.el10_2, glibc-minimal-langpack 2.39-142.el10_2
fixed: vendor fix RHSA-2026:76781
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nss_db 2.34-283.el9_8, nss_hesiod 2.34-283.el9_8, glibc-benchtests 2.34-283.el9_8
fixed: vendor fix RHSA-2026:79281
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) nss_db 2.39-142.el10_2, nss_hesiod 2.39-142.el10_2, glibc-benchtests 2.39-142.el10_2
fixed: vendor fix RHSA-2026:76781
Red Hat Enterprise Linux CRB (v. 8) nss_hesiod 2.28-251.el8_10.43, glibc-benchtests 2.28-251.el8_10.43
fixed: vendor fix RHSA-2026:76777
Red Hat Hardened Images glibc 2.43-8.1.hum1, libnsl 2.43-8.1.hum1, nss_db 2.43-8.1.hum1, glibc32 2.43-8.1.hum1, nss_hesiod 2.43-8.1.hum1, glibc-utils 2.43-8.1.hum1, +9 more
fixed: vendor fix RHSA-2026:53069
Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1791978528, rhui5/rhua-rhel9 1791978693, rhui5/haproxy-rhel9 1791978528, rhui5/installer-rhel9 1791964013, rhui5/cds-kubernetes-rhel9 1791978534
fixed: vendor fix RHSA-2026:82939
Red Hat Cost Management 4 costmanagement/costmanagement-metrics-operator-bundle 1793205914 Red Hat Hardened Images filesystem 3.18-59.hum1 Red Hat OpenShift AI (RHOAI) rhoai/odh-kserve-controller-rhel9, rhoai/odh-model-serving-api-rhel9, rhoai/odh-workbenches-operator-rhel9, rhoai/odh-llama-stack-k8s-operator-rhel9, rhoai/odh-kserve-llmisvc-controller-rhel9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-12)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.6	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U
CNA	4.0	6.6	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

The GNU C Library glibc

Classification

Weakness

CWE-121 Stack-based Buffer Overflow

References

sourceware.org /bugzilla/show_bug.cgi?id=34091
issue-tracking

Sources

CVE List CVE-2026-6791
NVD CVE-2026-6791

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary