CVE-2014-7187: Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remot...

Security readout for executives and security teams

CVE-2014-7187 is an old GNU Bash parsing bug. Specially crafted deeply nested loop input can crash Bash, causing denial of service, with the original record also noting possible unspecified impact. The source bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely on legacy Linux, Unix, and appliance environments still carrying vulnerable Bash builds. The bundle includes vendor advisories from VMware, IBM, HP, Check Point, and openSUSE, but does not provide a complete affected-product list. Prioritize validation on legacy and internet-adjacent systems, especially appliances. This is not confirmed actively exploited in the provided sources, but Bash is widely embedded and old vulnerable builds can persist unnoticed. Mitigation focus: Apply vendor Bash updates for affected operating systems and appliances.; Check VMware, IBM, HP, Check Point, and openSUSE advisories for product-specific fixes.; Replace or isolate unsupported systems that cannot receive Bash updates..

Prepared

Jun 14, 2026, 06:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.