CVE-2014-7186

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote...

10.0 HighPublic exploitFix available

CVE-2014-7186 is a high vulnerability (CVSS 10.0) in Gnu Bash, published September 25, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 64.3%, the 99th percentile. Fixed in bash 4.3-9.2.

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

Exploit likelihood

64.3%Down 20.2 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Record: CVE-2014-7186
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-7186
Updated: 2026-11-02

EUVDEUVD-2014-7063 No score

Record: EUVD-2014-7063
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w7vx-gpvr-f5cg No score

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote...

Record: GHSA-w7vx-gpvr-f5cg
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2014-7186
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-7186 No score

Record: DEBIAN-CVE-2014-7186
Updated: 2026-11-02

Show 4 moreShow less

OSVMGASA-2014-0394 No score

Updated bash packages fix multiple security vulnerabilities

Updated bash packages fix security vulnerabilities:

Bash has been updated to version 4.2 patch level 50, which further mitigates ShellShock-type vulnerabilities. Two such issues have already been discovered (CVE-2014-6277, CVE-2014-6278).

See the RedHat article on the backward-incompatible changes introduced by the latest patch, caused by adding prefixes and suffixes to the variable names used for exporting functions. Note that the RedHat article mentions these variable names will have parentheses "()" at the end of their names, however, the latest upstream patch uses two percent signs "%%" at the end instead.

Two other unrelated security issues in the parser have also been fixed in this update (CVE-2014-7186, CVE-2014-7187).

Record: MGASA-2014-0394
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10106-1 No score

bash-4.4-92.1 on GA media

These are all security issues fixed in the bash-4.4-92.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10106-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-7186 No score

Record: UBUNTU-CVE-2014-7186
Updated: 2026-11-02

OSVUSN-2364-1 No score

bash vulnerabilities

Florian Weimer and Todd Sabin discovered that the Bash parser incorrectly handled memory. An attacker could possibly use this issue to bypass certain environment restrictions and execute arbitrary code. (CVE-2014-7186, CVE-2014-7187)

In addition, this update introduces a hardening measure which adds prefixes and suffixes around environment variable names which contain shell functions.

Record: USN-2364-1
Updated: 2026-11-02

Affected products

gnu bash

Affected packages

Affected packages
Package	Affected	Fixed
`bash` Debian:12	before 4.3-9.2	4.3-9.2
`bash` Debian:13	before 4.3-9.2	4.3-9.2
`bash` Debian:14	before 4.3-9.2	4.3-9.2
`bash` Debian:6.0	before 4.1-3+deb6u2, plus listed versions 4.1-3	4.1-3+deb6u2
`bash` Debian:7	before 4.2+dfsg-0.1+deb7u3, plus listed versions 4.2+dfsg-0.14.2+dfsg-0.1+deb7u14.2+dfsg-0.1+deb7u2	4.2+dfsg-0.1+deb7u3
`bash` Mageia:3	before 4.2-50.2.mga3	4.2-50.2.mga3
`bash` Mageia:4	before 4.2-50.2.mga4	4.2-50.2.mga4
`bash` Red Hat:enterprise_linux:5::client	before 0:3.2-33.el5_11.4	0:3.2-33.el5_11.4
`bash-debuginfo` Red Hat:enterprise_linux:5::client	before 0:3.2-33.el5_11.4	0:3.2-33.el5_11.4
`bash` Red Hat:enterprise_linux:5::server	before 0:3.2-33.el5_11.4	0:3.2-33.el5_11.4

Show 52 moreShow less

Affected packages
Package	Affected	Fixed
`bash-debuginfo` Red Hat:enterprise_linux:5::server	before 0:3.2-33.el5_11.4	0:3.2-33.el5_11.4
`bash` Red Hat:enterprise_linux:6::client	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-debuginfo` Red Hat:enterprise_linux:6::client	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-doc` Red Hat:enterprise_linux:6::client	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash` Red Hat:enterprise_linux:6::computenode	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-doc` Red Hat:enterprise_linux:6::computenode	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash` Red Hat:enterprise_linux:6::server	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-debuginfo` Red Hat:enterprise_linux:6::server	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-doc` Red Hat:enterprise_linux:6::server	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash` Red Hat:enterprise_linux:6::workstation	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash-doc` Red Hat:enterprise_linux:6::workstation	before 0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
`bash` Red Hat:enterprise_linux:7::client	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-debuginfo` Red Hat:enterprise_linux:7::client	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-doc` Red Hat:enterprise_linux:7::client	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash` Red Hat:enterprise_linux:7::computenode	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-doc` Red Hat:enterprise_linux:7::computenode	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash` Red Hat:enterprise_linux:7::server	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-debuginfo` Red Hat:enterprise_linux:7::server	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-doc` Red Hat:enterprise_linux:7::server	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash` Red Hat:enterprise_linux:7::workstation	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash-doc` Red Hat:enterprise_linux:7::workstation	before 0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
`bash` Red Hat:rhel_els:4::as	before 0:3.0-27.el4.4	0:3.0-27.el4.4
`bash-debuginfo` Red Hat:rhel_els:4::as	before 0:3.0-27.el4.4	0:3.0-27.el4.4
`bash` Red Hat:rhel_els:4::es	before 0:3.0-27.el4.4	0:3.0-27.el4.4
`bash-debuginfo` Red Hat:rhel_els:4::es	before 0:3.0-27.el4.4	0:3.0-27.el4.4
`bash` Red Hat:rhel_mission_critical:5.6	before 0:3.2-24.el5_6.2	0:3.2-24.el5_6.2
`bash-debuginfo` Red Hat:rhel_mission_critical:5.6	before 0:3.2-24.el5_6.2	0:3.2-24.el5_6.2
`bash` Red Hat:rhel_eus:5.9	before 0:3.2-32.el5_9.3	0:3.2-32.el5_9.3
`bash-debuginfo` Red Hat:rhel_eus:5.9	before 0:3.2-32.el5_9.3	0:3.2-32.el5_9.3
`bash` Red Hat:rhel_eus:6.4::computenode	before 0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
`bash-debuginfo` Red Hat:rhel_eus:6.4::computenode	before 0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
`bash-doc` Red Hat:rhel_eus:6.4::computenode	before 0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
`bash` Red Hat:rhel_mission_critical:6.2::server	before 0:4.1.2-9.el6_2.2	0:4.1.2-9.el6_2.2
`bash-debuginfo` Red Hat:rhel_mission_critical:6.2::server	before 0:4.1.2-9.el6_2.2	0:4.1.2-9.el6_2.2
`bash` Red Hat:rhel_eus:6.4::server	before 0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
`bash-debuginfo` Red Hat:rhel_eus:6.4::server	before 0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
`bash-doc` Red Hat:rhel_mission_critical:6.2::server	before 0:4.1.2-9.el6_2.2	0:4.1.2-9.el6_2.2
`bash-doc` Red Hat:rhel_eus:6.4::server	before 0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
`bash` Red Hat:rhel_sjis:5	before 0:3.2-33.el5_11.1.sjis.2	0:3.2-33.el5_11.1.sjis.2
`bash-debuginfo` Red Hat:rhel_sjis:5	before 0:3.2-33.el5_11.1.sjis.2	0:3.2-33.el5_11.1.sjis.2
`bash` Red Hat:rhel_sjis:6	before 0:4.1.2-15.el6_5.1.sjis.2	0:4.1.2-15.el6_5.1.sjis.2
`bash-debuginfo` Red Hat:rhel_sjis:6	before 0:4.1.2-15.el6_5.1.sjis.2	0:4.1.2-15.el6_5.1.sjis.2
`bash-doc` Red Hat:rhel_sjis:6	before 0:4.1.2-15.el6_5.1.sjis.2	0:4.1.2-15.el6_5.1.sjis.2
`rhev-hypervisor6` Red Hat:rhev_manager:3	before 0:6.5-20140930.1.el6ev	0:6.5-20140930.1.el6ev
`bash` Red Hat:rhel_sjis:5	before 0:3.2-32.el5_9.3.sjis.1	0:3.2-32.el5_9.3.sjis.1
`bash-debuginfo` Red Hat:rhel_sjis:5	before 0:3.2-32.el5_9.3.sjis.1	0:3.2-32.el5_9.3.sjis.1
`bash` Ubuntu:14.04:LTS	before 4.3-7ubuntu1.4, plus listed versions 4.2-5ubuntu34.3-1ubuntu24.3-2ubuntu14.3-3ubuntu14.3-4ubuntu1 Show 6 moreShow less 4.3-4ubuntu24.3-6ubuntu14.3-7ubuntu14.3-7ubuntu1.14.3-7ubuntu1.24.3-7ubuntu1.3	4.3-7ubuntu1.4
`bash` openSUSE:Tumbleweed	before 7.0-92.1	7.0-92.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	GNU bash 4.3.11 - Environment Variable dhclient	2014-10-02
Exploit-DB	dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)	2014-09-29

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 173 moreShow less