{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://index.boks.sh/vex/ldd-amd64",
  "author": "boks index <https://index.boks.sh>",
  "timestamp": "2026-08-25T12:15:59Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-6368"
      },
      "products": [
        {
          "@id": "pkg:deb/ubuntu/ldd@2.43-2ubuntu2.3?distro=ubuntu-26.04&upstream=glibc"
        },
        {
          "@id": "pkg:deb/ubuntu/glibc@2.43-2ubuntu2.3?distro=ubuntu-26.04"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Calling `wordexp` with WRDE_APPEND can leave invalid memory in the `we_wordv`\nmember, which a later `wordfree` may abort on. Both are glibc functions; the\ndefect is in the C library's compiled code and is reached by calling into it.\n\nRead off the bytes: the ldd image contains exactly one file, `bin/ldd`, 5347\nbytes. No libc.so.6, no ld-linux-*.so, nothing compiled. Nothing in that image\ncan call wordexp, because the implementation of wordexp is not in it.\n\nglibc is named in its SBOM because /bin/ldd is shipped by the glibc source\npackage via libc-bin, and file attribution names the owner of the path. The\ncomponent is present; the vulnerable code is not."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-6791"
      },
      "products": [
        {
          "@id": "pkg:deb/ubuntu/ldd@2.43-2ubuntu2.3?distro=ubuntu-26.04&upstream=glibc"
        },
        {
          "@id": "pkg:deb/ubuntu/glibc@2.43-2ubuntu2.3?distro=ubuntu-26.04"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "A defect in glibc's internal `parse_tilde`, which extracts a username from a\npath beginning with `~user` in order to look up that user's home directory. It\nis reached through the C library's own path-expansion interfaces -- wordexp and\nglob -- so running it requires glibc's compiled code.\n\nRead off the bytes rather than reasoned about: the ldd image contains exactly\none file, `bin/ldd`, 5347 bytes, and nothing else. No libc.so.6, no\nld-linux-*.so, no compiled object of any kind. It is a POSIX shell script, and\nthe \u00a724.1 coverage check -- fatal, both directions -- is what holds the document\nto that single file.\n\nglibc appears in its SBOM because /bin/ldd is a file the glibc SOURCE package\nships (through the binary package libc-bin), and file attribution names the\npackage that owns the path. The component is present; the vulnerable code is\nnot. Tilde expansion in the script, where it occurs at all, is the composed\nshell's, and that shell is a separate image with its own document and its own\nscan.\n\nThis is the same shape as CVE-2026-14456 and openssl in the base: an image\ninherits a package's paths without inheriting its code."
    }
  ]
}