Description
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
Affected products
gnu: glibc; netapp: active iq unified manager; netapp: e-series santricity os controller; netapp: hci management node; netapp: ontap select deploy administration utility; netapp: solidfire; debian: debian linux
References10
- lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing ListThird Party Advisory
- security.gentoo.org/glsa/202208-24 Third Party Advisory
- security.netapp.com/advisory/ntap-20210827-0005/ Third Party Advisory
- sourceware.org/bugzilla/show_bug.cgi?id=28011 Issue TrackingThird Party Advisory
- sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384… Broken Link
- sourceware.org/glibc/wiki/Security%20Exceptions Not Applicable
- lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing ListThird Party Advisory
- security.gentoo.org/glsa/202208-24 Third Party Advisory
- security.netapp.com/advisory/ntap-20210827-0005/ Third Party Advisory
- sourceware.org/bugzilla/show_bug.cgi?id=28011 Issue TrackingThird Party Advisory
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - EPSS — exploit probability
- 3% percentile: 86 · as of 7 November 2026
- CWE
- CWE-190CWE-704
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.