CVE-2014-7169 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution

Exploited in the wild Critical 9.8 Published 25 Sep 2014 Updated 22 Oct 2025

Remote attackers can execute arbitrary code or write files via crafted environment variables in Bash, affecting systems using SSH, CGI, or DHCP clients.

Exploited in the wild: Since 28 Jan 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-7169?

CVE-2014-7169 is a critical code injection vulnerability in Apple Mac Os X, published on 25 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Weakness: CWE-78

Which versions are affected by CVE-2014-7169?

It affects 74 products.

Products include Apple Mac Os X, Arista Eos, Canonical Ubuntu Linux, Checkpoint Security Gateway, Citrix Netscaler Sdx Firmware, Debian Debian Linux and 68 more.

How do I fix CVE-2014-7169?

Apply the vendor's patch. US federal agencies must fix it by 28 Jul 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2014-7169 being exploited?

Yes. Attackers have exploited CVE-2014-7169 in the wild since at least 28 Jan 2022.

Public exploit code: 15 Exploit-DB entries and 4 proofs of concept on GitHub.

All Apple Mac Os X vulnerabilities

Sources

Also known as CVE-2014-3659, CVE-2014-7196, DEBIAN-CVE-2014-7169, GHSA-f7j6-xrjp-vffg, MGASA-2014-0393, UBUNTU-CVE-2014-7169 and 2 more.