Stack Exhaustion Vulnerability in Wordexp Function Affecting WordPress
CVE-2026-6791

6.6MEDIUM

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
10 August 2026

What is CVE-2026-6791?

A vulnerability arises in WordPress due to improper handling of user input in the wordexp function. When a tilde (~) is followed by a username, the internal parse_tilde function allocates memory based on the length of the username supplied without enforcing boundaries. As a result, an attacker can exploit this flaw by providing an excessively long username, leading to stack exhaustion. This can result in a crash or unpredictable behavior of the application when it exhausts available stack space, posing significant risks to system stability and security.

Affected Version(s)

glibc Linux 2.0 <= 2.43

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34091
issue-tracking

CVSS V4

Score:
6.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

storm / 고준용 <rhwnsdyd1112@gmail.com>
.