GNU gawk
CVE-2026-40468
LOW
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local tool with attack prerequisites (AT:P maps to AC:H); any user can run gawk (PR:N); no confidentiality impact; limited integrity and availability.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.
AnalysisAI
Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhaustion when gawk processes attacker-crafted input. The flaw stems from a CWE-190 integer wraparound condition that can be triggered locally to overwrite heap objects with attacker-controlled bytes, potentially escalating from a denial-of-service to memory corruption with partial integrity impact. No public exploit identified at time of analysis, and CERT-PL reported this with a low CVSS 4.0 base score of 2.1, reflecting a limited, local attack surface with specific attack prerequisites.
Technical ContextAI
GNU gawk (GNU awk) is the GNU Project's implementation of the AWK text-processing language, widely installed on Linux and Unix systems as a core scripting utility. The vulnerability resides in builtin.c, the source file implementing gawk's built-in functions (e.g., length, substr, split). CWE-190 (Integer Overflow or Wraparound) describes a condition where arithmetic on integer values exceeds the type's bounds, causing the result to wrap around unexpectedly. In gawk's context, an overflowing integer used in memory allocation or indexing calculations can result in an undersized heap allocation, subsequently enabling heap metadata corruption when oversized data is written into the allocated region. The affected CPE is cpe:2.3:a:gnu:gawk:*:*:*:*:*:*:*:* covering all gawk versions through 5.4.0. The upstream fix is available via a named commit on the GNU Savannah git repository.
RemediationAI
Vendor-released patch: upstream fix committed to the GNU gawk Savannah repository (commit 062f2f2581b991362c046f7f2e238ffa34e6f8c7), available at https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7. Users should upgrade to a distribution-packaged release that includes this commit, or build gawk from source at a revision equal to or newer than this commit. A patched tagged release version was not independently confirmed from the available reference data. As a compensating control where patching is not immediately possible, restrict gawk-based scripts from processing untrusted external data - specifically, audit pipelines where attacker-influenced input is passed to gawk without sanitization of large numeric arguments to built-in functions. Disabling or sandboxing (e.g., via seccomp or containers) scripts that call gawk on untrusted input limits the blast radius of exploitation.
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. Rated high severity (CVSS 7.1), this vulnerab
Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases
Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the
Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the g
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today