CVE-2026-6791: Tilde Path Expansion Buffer Overflow Risk

CVE-2026-6791 Overview

CVE-2026-6791 is a stack-based buffer vulnerability [CWE-121] in the tilde expansion path of the wordexp function. The internal parse_tilde helper extracts a username from paths beginning with ~username to resolve the user's home directory. The routine allocates storage for the extracted username on the stack using the strndupa macro, sized directly from attacker-controlled input length. Supplying a username of thousands of characters exhausts the thread's stack region and triggers a stack clash. Applications that pass untrusted input to wordexp are exposed to denial of service and, depending on adjacent memory layout, potential memory corruption.

Critical Impact
Attackers passing crafted ~username strings to applications that call wordexp on untrusted input can exhaust stack memory and crash the process, with a possible path to memory corruption through stack collisions.

Affected Products

Implementations of the wordexp function that use strndupa for tilde-username expansion (see Sourceware Bug Report #34091)
Applications on affected systems that pass untrusted input to wordexp
Any downstream software linking against the vulnerable library build

Discovery Timeline

2026-08-10 - CVE-2026-6791 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-6791

Vulnerability Analysis

The defect resides in parse_tilde, the internal handler invoked by wordexp when a word begins with a tilde (~) followed by a username. The function must isolate the username substring before performing a home-directory lookup. To do so it calls strndupa, a macro that allocates memory on the caller's stack frame using alloca semantics. The allocation size equals the attacker-controlled username length with no upper bound.

When the username spans thousands of characters, the stack pointer moves past the current stack region and into adjacent memory, a class of flaw known as a stack clash. On systems without a sufficiently large stack guard, the write can skip the guard page entirely and corrupt neighboring memory such as the heap or another thread's stack.

Root Cause

The root cause is the absence of length validation before invoking strndupa inside parse_tilde. The macro provides no bounds enforcement, so it inherits the trust boundary of the caller. Because wordexp is documented to accept user-supplied words, any caller that forwards untrusted input propagates the missing bounds check to parse_tilde.

Attack Vector

Exploitation requires an application to pass attacker-controlled data to wordexp without pre-sanitizing tilde-prefixed tokens. The attacker submits a string of the form ~AAAA...A/ where the A sequence contains thousands of bytes. Processing that token drives the stack pointer past the guard region. The result is a crash at minimum and, when stack and heap or adjacent thread stacks are close, memory corruption that can influence control flow.

Refer to the Sourceware Bug Report #34091 for the upstream technical discussion.

Detection Methods for CVE-2026-6791

Indicators of Compromise

Process crashes with segmentation faults inside parse_tilde or wordexp call chains
Core dumps showing unusually large stack allocations preceding the fault address
Input logs containing tilde-prefixed tokens with username fields exceeding several hundred bytes

Detection Strategies

Inspect application input pipelines for calls to wordexp that receive network or user-supplied strings
Alert on abnormal SIGSEGV terminations of long-running services that perform shell-style word expansion
Static-analysis rules that flag strndupa and alloca allocations sized by external inputs

Monitoring Recommendations

Enable core dump collection on services that parse user-supplied paths and forward reports to a central store
Track process termination telemetry for repeated crashes correlated with request payloads containing long ~ tokens
Use eBPF-based endpoint telemetry to record oversized read/recv payloads immediately preceding process exits

How to Mitigate CVE-2026-6791

Immediate Actions Required

Audit application code for callers of wordexp that accept untrusted input and add explicit length checks on tilde-prefixed tokens
Reject or truncate ~username inputs before invocation, capping the username portion at LOGIN_NAME_MAX or a comparably small value
Deploy the fixed library build referenced in the upstream bug once available and rebuild statically linked dependents

Patch Information

Upstream tracking is available through Sourceware Bug Report #34091. Apply the vendor-supplied patch for the affected library once distributed by your operating system vendor and restart services that link against it.

Workarounds

Sanitize inputs to strip or bound the username segment of tilde expressions before calling wordexp
Prefer WRDE_NOCMD combined with pre-parsed path resolution routines such as getpwnam on validated usernames
Ensure kernels are configured with an adequate stack guard gap (for example, vm.heap-stack-guard sized to at least 1 MiB) to raise the cost of stack-clash exploitation

bash

# Configuration example: enforce a larger stack guard gap on Linux
sudo sysctl -w vm.heap-stack-guard-gap=1048576
# Persist the setting
echo 'vm.heap-stack-guard-gap=1048576' | sudo tee /etc/sysctl.d/99-stack-clash.conf