HackerFeeds
All CVEs

CVE-2014-6278

HIGH8.8
CISA KEV

Published 2014-09-30 · Updated 2026-06-17 · Source security@debian.org

Summary

CVE-2014-6278 is a high-severity (CVSS 8.8) vulnerability in GNU GNU Bash. CISA added it to the Known Exploited Vulnerabilities catalog on October 2, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 23, 2025. CISA does not currently list it as used in ransomware campaigns. GNU has 5 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 5 known-exploited GNU vulnerabilities →

Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-78CWE-78

CISA Known-Exploited Vulnerability

Product: GNU — GNU Bash

Name: GNU Bash OS Command Injection Vulnerability

Date added: 2025-10-02 · Due: 2025-10-23

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD