CVE-2026-6791

What it is

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-10 19:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-24 16:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-10 19:17 UTC

Last modified

2026-10-24 16:10 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-121

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 6.6

Attack vector

Network

Complexity

High

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

High