Skip to main content

GNU gawk CVE-2026-40467

MEDIUM
Use After Free (CWE-416)
2026-07-13 CERT-PL
Denial Of Service Use After Free Memory Corruption Red Hat Suse Gawk Gnu
5.1
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.0 MEDIUM

Local vector requires script execution access; crash-only outcome yields A:L with no confidentiality or integrity impact and unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.0 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
4.0 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 13, 2026 - 13:16 vuln.today
CVE Published
Jul 13, 2026 - 12:07 cve.org
MEDIUM 5.1

DescriptionCVE.org

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.

AnalysisAI

Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the gawk process, causing a denial of service. All gawk versions 5.4.0 and below are affected, as confirmed by CERT-PL and an upstream patch commit. No active exploitation has been identified (not in CISA KEV), and the impact is confined to availability - no confidentiality or integrity effects have been demonstrated.

Technical ContextAI

The flaw (CWE-416: Use After Free) resides in the do_getline_redir() function in gawk's io.c source file. GNU gawk is the GNU Project's implementation of the AWK text-processing language. Use-after-free vulnerabilities arise when a program dereferences a pointer to heap memory that has already been freed, leading to undefined behavior - typically a crash, and in some cases exploitable memory corruption. The do_getline_redir() function handles getline I/O redirection constructs within AWK scripts, meaning the vulnerable code path is exercised when an AWK program uses getline with input redirection. The CPE cpe:2.3:a:gnu:gawk:*:*:*:*:*:*:*:* with an upper version bound of 5.4.0 covers all prior stable releases distributed by GNU and downstream Linux packagers.

RemediationAI

Apply the upstream patch available via commit a2d18c74109e41bec29a23098eba2e00057286d8 in the GNU gawk repository (https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8). A formally tagged released version incorporating this fix has not been independently confirmed from available data - monitor the GNU gawk release page and distribution security advisories for a patched package version. For systems where patching is not immediately feasible, restrict execution of untrusted or externally-supplied AWK scripts by gawk, particularly those using getline with I/O redirection; this eliminates the triggerable code path but may break legitimate use cases in log processing or scripting pipelines. Additional guidance is available in the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-40467.

More in Gawk

View all
CVE-2023-4156 HIGH POC
7.1 Sep 25

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. Rated high severity (CVSS 7.1), this vulnerab
CVE-2026-40553 MEDIUM
5.1 Jul 13

Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases
CVE-2026-40469 MEDIUM
5.1 Jul 13

Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the

CVE-2026-40468 LOW
2.1 Jul 13

Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhausti

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-40467 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy