CVE-2014-7169VulnerabilityPublished 01/28/2022Updated 10/24/2026

CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Affects GNU Bourne-Again Shell (Bash)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/28/2022
KEV deadline: 07/28/2022
EPSS: 99.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2014-7169 (opens in a new tab)

Description

CVE-2014-7169 is a high-severity vulnerability in GNU Bash versions through 4.3 that allows remote attackers to execute arbitrary code by exploiting the way Bash processes trailing strings after function definitions in environment variable values. This vulnerability is a follow-up fix to CVE-2014-6271 and has been exploited in the wild.

Summary

GNU Bash versions up to 4.3 improperly handle trailing strings after function definitions in environment variables, enabling remote code execution. This vulnerability, identified as CVE-2014-7169, corrects the incomplete remediation of the earlier Shellshock vulnerability (CVE-2014-6271). It allows attackers to execute arbitrary commands remotely by crafting environment variables that Bash processes insecurely.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The vulnerability has been observed in active exploitation campaigns, indicating a real-world threat to vulnerable Bash installations.

Mitigation

The vendor has released patches addressing this vulnerability. Users should apply the official Bash updates that fix CVE-2014-7169. Since this is not a cloud service, remediation depends on applying vendor patches to affected systems. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the GNU Bash vendor advisory for the latest remediation guidance.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:10:31 UTC

Weaknesses

References

Related threats