CVE-2025-15281: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
Published Jan 20, 2026
·Updated
Calling wordexp with WRDEREUSE in conjunction with WRDEAPPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the wewordv member, which on subsequent calls to wordfree may abort the process.
Affected Software
3 affected components
GNU C Library>=2.0<2.42
GNU glibc>=2.0<2.43
IBM API Connect V12 OnPrem<=All
Event History
Jan 20, 2026
CVE Published
via MITRE·01:22 PM
Data Sourced
via MITRE·01:22 PM
DescriptionWeakness
Data Sourced
via Red Hat·02:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·02:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 7, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-15281?
CVE-2025-15281 is considered a high severity vulnerability due to the potential exposure of uninitialized memory.
2
How do I fix CVE-2025-15281?
To fix CVE-2025-15281, update the GNU C Library to a version later than 2.42.
3
Which versions of the GNU C Library are affected by CVE-2025-15281?
CVE-2025-15281 affects GNU C Library versions from 2.0 to 2.42.
4
What could be the consequences of exploiting CVE-2025-15281?
Exploiting CVE-2025-15281 may lead to the disclosure of sensitive information due to uninitialized memory access.
5
Is CVE-2025-15281 dependent on specific usage patterns of wordexp?
Yes, CVE-2025-15281 specifically arises when using wordexp with both WRDE_REUSE and WRDE_APPEND flags.