The glibc wordexp function implements tilde expansion by parsing a path that starts with a tilde and a username. Inside the parse_tilde routine the username is copied onto the stack with the strndupa macro, allocating exactly the length of the supplied username without a bounds check. When an attacker supplies an excessively long username, the stack allocation grows until the thread’s stack space is exhausted, causing a stack clash and resulting in an application crash. This flaw involves a buffer copy with an incorrect size specification (CWE‑120) and a stack‑based buffer overflow (CWE‑121), leading to denial of service.

The vulnerability exists in the GNU C Library (glibc) on any platform where the current wordexp implementation contains the unpatched code. No specific version numbers are provided, so all releases that have not yet incorporated the fix are potentially vulnerable.

The CVSS score of 6.6 indicates moderate severity, and the EPSS score of 0.00207 indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a very long tilde‑prefixed username that reaches the wordexp function in the target process; no remote exploitation path is documented. Because the issue leads to a stack exhaustion, any process that employs wordexp and receives untrusted input could crash, causing disruption to that process.