CVE-2026-6791: glibc wordexp Stack Clash via Tilde Expansion
CVE-2026-6791 is a stack-based buffer overflow in glibc's wordexp() function. The parse_tilde internal function uses strndupa to allocate stack memory sized by attacker input with no bounds check, enabling a stack clash.
Contents
TL;DR: CVE-2026-6791 is a stack-based buffer overflow in the GNU C Library's wordexp() function. When expanding a tilde-prefixed username, the parse_tilde internal function uses strndupa to allocate stack memory sized by attacker input with no bounds check. An application that passes untrusted input to wordexp() can be crashed or have its execution flow hijacked via a stack clash.
What happened
The GNU C Library, the foundational C runtime used by nearly every Linux distribution, contains a stack clash vulnerability in its POSIX word expansion interface. The wordexp() function takes a string and expands it the way a shell would: resolving environment variables, command substitutions, and tilde-prefixed home directory paths. When it encounters a tilde followed by a username (like ~alice/projects), the internal parse_tilde function extracts the username to look up the user's home directory via getpwnam_r.
The problem is how parse_tilde copies that username. It uses strndupa, a macro that allocates memory directly on the stack by advancing the stack pointer. The size of the allocation equals the length of the user-supplied username string. There is no bounds check. A username of tens of thousands of characters will push the stack pointer past the thread's allocated stack region, colliding with adjacent memory pages. This is a textbook stack clash: the attacker smashes the guard page and writes into memory they should never reach.
The fix, submitted by Adhemerval Zanella at Linaro in April 2026, replaces strndupa with a scratch_buffer: a heap-backed, growable buffer that glibc already uses for the getpwnam_r call itself. The username gets copied into the reusable buffer instead of carved out of the stack, so input length no longer affects the stack pointer.
Who is affected
glibc is the C library shipped with Ubuntu, Debian, Fedora, RHEL, Alpine (glibc variant), Arch, and most other Linux distributions. It is the single most widely deployed system library on Earth. Every process running on a typical Linux system links against it.
The vulnerable code path is wordexp(), a POSIX function that not all applications call. The risk is concentrated in programs that pass user-controlled input to wordexp() without sanitization. Mail clients that expand ~user notation, shell utilities, build systems, and CI pipelines that process external input are the most likely exploit targets. If your application never calls wordexp(), the vulnerability does not reach you.
NVD classifies this as CWE-121: Stack-based Buffer Overflow. No CVSS score has been assigned yet as of publication. The CVE was published on 2026-08-10 via the CVE List V5 source.
What to do
If your application calls wordexp() with any input that originates from an untrusted source, you need to patch glibc. The fix is in the upstream glibc repository and corresponds to sourceware bug 34091.
For distro users: Wait for your distribution's security update. Ubuntu, Debian, RHEL, and Fedora will backport the patch and ship it through their normal update channels. Check your package manager for a glibc update dated August 2026 or later.
For developers: Audit your codebase for wordexp() calls. If you find any, validate or truncate the input before passing it. The POSIX specification does not require wordexp to handle unbounded input safely, so the caller bears the responsibility.
For maintainers building from source: The patch replaces the strndupa call in posix/wordexp.c's parse_tilde with a scratch_buffer that reuses the buffer already allocated for getpwnam_r. Pull from the glibc git repository after the fix commit lands.
Why it matters
Stack clash attacks are dangerous because they bypass common mitigations. Stack canaries, ASLR, and NX bits assume the attacker overwrites a return address on a fixed-size stack frame. A stack clash instead walks the stack pointer into unrelated memory regions, which can include heap data, mapped libraries, or other thread stacks. The technique was formalized in 2017 by researchers at Qualys, who demonstrated it against glibc, Apache, Samba, and ProFTPD.
This particular bug requires a specific trigger: an application must pass attacker-controlled input to wordexp(). That narrows the attack surface compared to a bug in printf or getpwnam, which nearly every program calls. But for the programs that do use wordexp with external input, the impact is a denial-of-service crash at minimum and potential remote code execution in worst-case scenarios.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.