CVE-2021-35942EPSS p86.0%
CVE-2021-35942CVE-2021-35942
gnu / glibc
Description
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
Scoring
| CVSS | 9.1 () |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| EPSS | 2.75% probability of exploitation · percentile 86.0% · 2026-10-17T12:00:28Z |
| Last modified | 2026-10-14 |