CVE-2014-7186
bash: parser can allow out-of-bounds memory access while handling redir_stack
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · September 25, 2014
Updated · June 28, 2026
Description
It was identified that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code.
Statement
A patch for this issue was applied to the bash packages in Red Hat Enterprise Linux via RHSA-2014:1306, RHSA-2014:1311, and RHSA-2014:1312. The errata do not mention the CVE in the description, as the CVE was only assigned after those updates were released.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.6AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer