ZeroDay Findings
Sign inSign up

Findings

CVE-2021-35942

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted…

Published Jul 22, 2021 · updated Oct 14, 2026 · gnu glibc

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 22, 2021 · NIST NVD

    Detected

    The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

  2. Oct 14, 2026 · NIST NVD

    Updated

    The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Affected

  • cpe debian/debian linux10.0
  • cpe gnu/glibcversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/e-series santricity os controllerversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe netapp/solidfireversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2021-35942

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-35942

    30-day exploitation probability 2.8%

    first.org
  • NIST NVDVulnerability recordCVE-2021-35942

    The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because

    nvd.nist.gov

References