The vulnerability resides in the wordexp function of the GNU C Library. When the WRDE_APPEND flag is supplied, the function may populate the we_wordv member with pointers to uninitialized or freed memory. A subsequent call to wordfree on that array can trigger an abort, terminating the process. This weakness is classified as CWE‑908 and CWE‑1341 and its CVSS score of 2.1 indicates a low severity, though it can cause a denial of service when an application crashes.

The GNU C Library (glibc) versions 2.0 through 2.43 are affected. Any application linked against these releases and that calls wordexp with the WRDE_APPEND flag is vulnerable. This includes system libraries and binaries that rely on glibc for shell-completion or word expansion.

The CVSS score of 2.1 reflects low severity. The EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local or requires privileged code execution; an attacker would need to trigger a vulnerable application to invoke wordexp with the WRDE_APPEND option. Remote exploitation through an exposed interface is unlikely unless an application provides user-controlled input that influences the WRDE_APPEND usage. If achieved, the exploit would lead to a denial of service by aborting the target process.