Skip to main content

GNU gawk CVE-2026-40553

MEDIUM
Stack-based Buffer Overflow (CWE-121)
2026-07-13 CERT-PL
RCE Buffer Overflow Stack Overflow Red Hat Suse Gawk Gnu
5.1
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.1 MEDIUM

Local vector because gawk is a CLI tool; PR:N since any local user can run it; no confidentiality impact; low integrity and availability from crash and potential stack corruption.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.2 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 13, 2026 - 13:18 vuln.today
CVE Published
Jul 13, 2026 - 12:07 cve.org
MEDIUM 5.1

DescriptionCVE.org

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.

AnalysisAI

Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases through version 5.4.0, enabling a local attacker to crash the process and theoretically achieve code execution. The RCE angle is explicitly unconfirmed by the reporter (CERT-PL), making denial-of-service the primary demonstrated impact at this time. No public exploit identified at time of analysis; an upstream source-level patch commit is available on GNU Savannah.

Technical ContextAI

gawk is the GNU Project's implementation of the AWK text-processing language, shipped by default on virtually every major Linux distribution. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: the ftype() function inside extension/readdir.c writes data beyond the bounds of a stack-allocated buffer. The readdir extension provides directory-traversal capabilities to gawk scripts, and ftype() classifies filesystem entry types within that extension. Because the overflowed buffer resides on the stack, adjacent frame data - including saved return addresses - may be corrupted, creating the theoretical potential for control-flow hijack. This path is constrained in practice by modern mitigations such as stack canaries, ASLR, and NX. CPE cpe:2.3:a:gnu:gawk:*:*:*:*:*:*:*:* covers all gawk variants through 5.4.0.

RemediationAI

Monitor your Linux distribution's package feed for an updated gawk package that incorporates the upstream fix commit (https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843) and apply it as soon as available. The CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-40467 should be reviewed for any additional researcher guidance. If a packaged update is not yet available and gawk is used to process externally-supplied or untrusted directory paths, consider restricting execution of gawk in those pipelines as a compensating control - be aware that disabling readdir-extension-dependent scripts will break any gawk programs that enumerate directories using that extension. No exact patched release version number was confirmed in the available data; do not infer a specific version beyond what is stated here.

More in Gawk

View all
CVE-2023-4156 HIGH POC
7.1 Sep 25

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. Rated high severity (CVSS 7.1), this vulnerab
CVE-2026-40469 MEDIUM
5.1 Jul 13

Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the

CVE-2026-40467 MEDIUM
5.1 Jul 13

Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the g
CVE-2026-40468 LOW
2.1 Jul 13

Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhausti

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-40553 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy