GLIBC-SA-2026-0014 on CTRL-OS 26.05

Aliases: GLIBC-SA-2026-0014, CVE-2026-6368

Packages: glibc

Status: Plausible

Advisory Information

Calling wordexp with WRDE_APPEND in conjunction with an invalid expansion
(where an error like WRDE_BADCHAR would be returned) can create a stale
address in the wordexp_t that can cause an invalid free from wordfree.
This affects the GNU C Library version 2.0 to version 2.43.

In WRDE_APPEND mode, wordexp saves the caller-visible wordexp_t state
before appending the processing input.  If the word expansion grows
we_wordv via realloc, and realloc requires moving we_wordv to a new memory
location (instead of expanding in-place), and the expansion later fails,
the rollback fails to properly restore all previous we_wordv values and
may add stale pointers into the caller-visible state.  A subsequent
wordfree may then issue an invalid call to free().

CVE-Id: CVE-2026-6368
Public-Date: 2026-07-14
Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260)
Reported-by: shinobu

Updates

2026-07-23 23:34 CEST

Metadata changes:

• Status for package glibc: “Plausible”

2026-07-15 15:56 CEST

Metadata changes:

• Status for package glibc: “New”