Red Hat Security Advisory

RHSA-2026:76777

glibc security update

Released 2026-10-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) compat-libpthread-nonshared-2.28-251.el8_10.43, glibc-utils-2.28-251.el8_10.43
Red Hat Enterprise Linux BaseOS (v. 8) glibc-2.28-251.el8_10.43, glibc-all-langpacks-2.28-251.el8_10.43, glibc-common-2.28-251.el8_10.43 +47
Red Hat Enterprise Linux CRB (v. 8) glibc-benchtests-2.28-251.el8_10.43, glibc-nss-devel-2.28-251.el8_10.43, glibc-static-2.28-251.el8_10.43 +1

Fixes 2 records

TI-2026-05955 CVE-2026-6791 · GHSA-ch73-g8qv-r6r5

Potential stack-based buffer clash during tilde expansion in wordexp

LOW 29

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.0022 Published 2026-08-10 Partial fix CWE-121

TI-2026-05587 CVE-2026-6368 · GHSA-cm6j-gmqf-j2cm

wordexp with WRDE_APPEND can return or use invalid memory

LOW 10

Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00107 Published 2026-08-10 Partial fix · 2.43 CWE-908