GNU glibc up to 2.42 uninitialized resource

Summaryinfo

A vulnerability was found in GNU glibc up to 2.42. It has been rated as problematic. This affects an unknown function. Performing a manipulation results in uninitialized resource. This vulnerability was named CVE-2025-15281. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in GNU glibc up to 2.42. It has been classified as problematic. This affects an unknown function. The manipulation with an unknown input leads to a uninitialized resource vulnerability. CWE is classifying the issue as CWE-908. The product uses or accesses a resource that has not been initialized. This is going to have an impact on availability. The summary by CVE is:

Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

The weakness was presented by Vitaly Simonovich. It is possible to read the advisory at sourceware.org. This vulnerability is uniquely identified as CVE-2025-15281 since 12/29/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 294814 (Linux Distros Unpatched Vulnerability : CVE-2025-15281), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (294814), EUVD (EUVD-2026-3385) and CERT Bund (WID-SEC-2026-0179). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source GNU libc
• Dell Secure Connect Gateway
• IBM QRadar SIEM

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• glibc

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion