Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
References
| Link | Resource |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=33814 | Issue Tracking Patch |
| http://www.openwall.com/lists/oss-security/2026/01/20/3 | Mailing List Third Party Advisory |
Configurations
History
05 Feb 2026, 17:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sourceware.org/bugzilla/show_bug.cgi?id=33814 - Issue Tracking, Patch | |
| References | () http://www.openwall.com/lists/oss-security/2026/01/20/3 - Mailing List, Third Party Advisory | |
| First Time |
Gnu
Gnu glibc |
|
| CPE | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
22 Jan 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
20 Jan 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jan 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 14:16
Updated : 2026-02-05 17:43
NVD link : CVE-2025-15281
Mitre link : CVE-2025-15281
CVE.ORG link : CVE-2025-15281
JSON object : View
Products Affected
gnu
- glibc
CWE
CWE-908
Use of Uninitialized Resource