CVE-2012-6711: GNU Bash

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().

Affected products

• GNU Bash: from 4.2, up to and including 4.3
• Red Hat Enterprise Linux: version 7.0 only

Published 2019-06-18. Last modified 2026-06-16.