CVE-2020-1752
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out.
Published Apr 30, 2020 · updated Oct 14, 2026 · gnu glibc
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
Timeline
Detection, updates, and resolution for this record.
Apr 30, 2020 · NIST NVD
Detected
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execu
Oct 14, 2026 · NIST NVD
Updated
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execu
Affected
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe canonical/ubuntu linux19.10
- cpe debian/debian linux10.0
- cpe gnu/glibcversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/h410c firmwareversion unspecified
- cpe netapp/hci management nodeversion unspecified
- cpe netapp/solidfireversion unspecified
- cpe netapp/steelstore cloud integrated storageversion unspecified
Sources
- CVE.orgCVE-2020-1752
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-1752
30-day exploitation probability 0.5%
first.org - NIST NVDCVE-2020-1752
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by cre
nvd.nist.gov