CVE-2026-6791: 
Wolfi 脆弱性の分析と軽減

CVE-2026-6791 is a stack-based buffer overflow vulnerability in the GNU C Library (glibc) affecting the wordexp function's tilde-expansion path parsing. The internal parse_tilde function allocates memory for a username on the stack using the strndupa macro without bounds checking, allowing an attacker to trigger a stack clash by supplying an excessively long username (e.g., thousands of characters). Affected versions span glibc 2.0 through 2.43. It was published on August 10, 2026, with a CVSS v4.0 base score of 6.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). The vulnerable code path is in the parse_tilde function within glibc's wordexp implementation: when a path beginning with ~<username> is processed, the username portion is extracted and allocated on the thread stack via strndupa, which uses a variable-length stack allocation sized directly from user-supplied input with no upper bound enforced. An attacker who can pass attacker-controlled strings to an application calling wordexp() can supply a username of thousands of characters, exhausting the thread's stack space and triggering a stack clash. The attack vector is Network with High complexity and no privileges or user interaction required (GitHub Advisory, glibc Bugzilla).

Successful exploitation primarily results in a Denial of Service (DoS) by crashing the affected application thread through stack exhaustion. Any application that passes untrusted, attacker-controlled input to the wordexp function is at risk, including web servers, file managers, or shell utilities that perform path expansion. The CVSS v4.0 scoring also indicates low confidentiality and integrity impact on the vulnerable system, and high availability impact on subsequent systems, suggesting potential for cascading service disruption in environments where glibc-linked services are chained (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, reflecting very low current probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploit maturity is rated "Unreported" in the CVSS v4.0 assessment. Qualys has added detection for this vulnerability (detection ID 6661877).

1. Identify a target application: Find an application linked against glibc ≤ 2.43 that passes user-supplied input to the wordexp() function — such as a file manager, shell utility, or web service performing path expansion.
2. Craft a malicious input: Construct a path string beginning with ~ followed by an extremely long username (e.g., ~ + A × 100,000 characters).
3. Deliver the payload: Submit the crafted string to the application through any input channel that reaches the wordexp() call — for example, a filename field, URL parameter, or API endpoint.
4. Trigger stack exhaustion: The parse_tilde function extracts the username and allocates it on the stack via strndupa without bounds checking, exhausting the thread's stack space and causing a stack clash.
5. Achieve denial of service: The affected thread crashes, causing the application to terminate or become unresponsive (GitHub Advisory, glibc Bugzilla).

• Logs: Application crash logs or core dumps referencing stack overflow or segmentation faults in threads processing path expansion; system logs (/var/log/syslog, journalctl) showing unexpected process terminations.
• Process: Abnormal termination of glibc-linked applications (e.g., SIGSEGV or SIGABRT signals) shortly after receiving input containing ~ followed by a very long string.
• Network: Repeated requests to application endpoints containing ~ followed by unusually long strings (thousands of characters) in path or filename parameters.
• File System: Core dump files (core.*) generated in application working directories following crashes.

Update glibc to a patched version beyond 2.43 once available from the glibc maintainers or your Linux distribution's package repositories. As a workaround, applications should validate and enforce a maximum length on usernames in tilde-expansion paths before passing them to wordexp. Avoid using wordexp on untrusted or attacker-controlled input entirely, or replace it with alternative path expansion mechanisms that include proper input validation. Monitor your Linux distribution (e.g., Wolfi, Solus) for backported patches (GitHub Advisory, glibc Bugzilla).

The vulnerability received coverage in the German Linux news outlet Pro-Linux.de as part of a broader glibc security advisory roundup. The Solus Linux community discussed it in their Week 30 2026 update thread. No notable individual researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation.