CVE-2014-7186: GNU Bash redirection stack out-of-bounds access via here documents

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 2.0 score of 10 with a network, unauthenticated vector and very high EPSS probability, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 mishandles here documents, causing an out-of-bounds array access in the redirection stack (the "redir_stack" issue). A remote attacker can crash the shell or possibly achieve unspecified other impact. Because Bash is widely deployed and often processes untrusted input, this is a serious availability and potential integrity risk.

Impact

An attacker can cause a denial of service by crashing the Bash process, and the out-of-bounds access may allow further unspecified impact such as memory corruption. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

Reachable remotely over the network with no authentication and no user interaction per the AV:N/AC:L/Au:N vector, by supplying crafted here-document content that Bash parses. Any service or script that passes attacker-controlled text into Bash redirection parsing is exposed.

Exploitation

Not listed in CISA KEV and no ransomware group usage is documented, but EPSS is high at 0.64336 (99.2nd percentile), indicating elevated likelihood of exploitation activity. Reference tags are empty, so no vendor or third-party confirmation of in-the-wild exploitation is provided.

What to do

• Patch Bash to a version later than 4.3 bash43-026, or apply the vendor fix for the redir_stack issue; prioritize internet-facing and shared-host systems.
• Avoid passing untrusted input into Bash here-document or redirection parsing; sanitize or reject crafted here-document content at application boundaries.
• Restrict which users and services can invoke Bash with attacker-influenced arguments, and run such services with least privilege.
• Monitor vendor advisories (Apple, openSUSE and others referenced) for updated packages and redeploy patched builds.

Detection

• Monitor for Bash process crashes or abnormal termination correlated with here-document or redirection-heavy input.
• Alert on repeated shell invocations containing here-document syntax from untrusted or remote-originating sources.
• Audit application and CGI logs for crafted here-document payloads reaching Bash, and review core dumps for out-of-bounds access in parse.y redirection handling.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.