Skip to main content

GNU gawk CVE-2026-40469

MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-07-13 CERT-PL
Denial Of Service Integer Overflow Red Hat Suse Gawk Gnu
5.1
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.0 MEDIUM

Local vector because gawk processes input on the local system; PR:N since any user can invoke gawk with crafted input; impact is crash-only so A:L, C:N, I:N.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.0 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
2.8 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 13, 2026 - 13:17 vuln.today

DescriptionCVE.org

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.

AnalysisAI

Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the process. Affecting all gawk versions through 5.4.0 compiled for 32-bit architectures, this flaw was reported by CERT-PL and is limited exclusively to the availability domain - the CVSS 4.0 vector confirms no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and a patch commit is available upstream.

Technical ContextAI

GNU gawk is the GNU Project's canonical AWK interpreter, widely shipped in Linux distributions and Unix-like systems for text processing. The vulnerability resides in the do_sub() function within builtin.c, which implements gawk's sub() and gsub() substitution built-ins. CWE-190 (Integer Overflow or Wraparound) identifies the root cause: on 32-bit platforms, pointer arithmetic or size computations in do_sub() can exceed 32-bit integer bounds, producing incorrect memory offsets that allow heap metadata and adjacent gawk objects to be overwritten. On 64-bit builds the wider integer space prevents this wraparound, which is why the vulnerability is architecture-scoped. The affected CPE is cpe:2.3:a:gnu:gawk:*:*:*:*:*:*:*:* with a version ceiling of 5.4.0.

RemediationAI

The primary fix is to apply the upstream patch commit available at https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b. Because no specific patched release version has been confirmed in available data, users should either build gawk from the patched source tree or await a distribution-packaged update. As a structural workaround, migrating any 32-bit gawk deployment to a 64-bit build fully eliminates this specific vulnerability due to the architectural constraint - this is the most effective interim mitigation with no functional trade-off where 64-bit is available. In environments where 32-bit gawk processes untrusted or externally supplied input (e.g., log-processing pipelines, automation scripts), restrict the input source or sandbox the gawk process (e.g., via systemd sandboxing or container isolation) to limit the availability impact of a crash until patched binaries are deployed.

More in Gawk

View all
CVE-2023-4156 HIGH POC
7.1 Sep 25

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. Rated high severity (CVSS 7.1), this vulnerab
CVE-2026-40553 MEDIUM
5.1 Jul 13

Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases
CVE-2026-40467 MEDIUM
5.1 Jul 13

Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the g
CVE-2026-40468 LOW
2.1 Jul 13

Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhausti

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-40469 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy