The vulnerability arises from the parse_tilde function in glibc's wordexp implementation, which uses the strndupa macro to allocate stack memory for a username extracted from a tilde-prefixed path. Because the allocation size is based directly on the length of attacker-controlled input without bounds checking, an excessively long username can exhaust the thread's stack space, leading to a stack-based buffer overflow (CWE-121). This can be triggered if an application passes untrusted input to the wordexp function. The vulnerability is identified as CVE-2026-6791 and affects glibc version 2.0. The CVSS 4.0 score is 6.6 (medium severity). No known exploits are reported in the wild, and no official remediation or patch has been published yet.

An attacker who can supply untrusted input to the wordexp function can cause a stack clash by overflowing the stack with an excessively long username. This may lead to application crashes or potentially enable further exploitation depending on the context. The impact is limited by the requirement for attacker-controlled input to wordexp and the high attack complexity indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted or attacker-controlled input to the wordexp function or any functionality that expands tilde-prefixed paths with usernames.