CVE-2026-40468

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code.

Security Fix(es):

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.(CVE-2026-40467)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.(CVE-2026-40468)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.(CVE-2026-40469)

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.(CVE-2026-40553)

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code.

Security Fix(es):

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.(CVE-2026-40467)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.(CVE-2026-40468)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.(CVE-2026-40469)

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.(CVE-2026-40553)

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code.

Security Fix(es):

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.(CVE-2026-40467)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.(CVE-2026-40468)

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.(CVE-2026-40553)

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code.

Security Fix(es):

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.(CVE-2026-40467)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.(CVE-2026-40468)

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.(CVE-2026-40553)

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code.

Security Fix(es):

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.(CVE-2026-40467)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.(CVE-2026-40468)

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.(CVE-2026-40469)

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.(CVE-2026-40553)

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

• gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)

• gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553)

• gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

• gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)

• gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

• gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)

• gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553)

• gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

• gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)
• gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553)
• gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

• gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)
• gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

• gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)
• gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553)
• gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

• CVE-2026-40468: builtin.c (do_sub): make sofar be size_t to avoid an integer overflow that could corrupt the heap during sub/gsub/gensub on very large buffers.

• CVE-2026-40467: fix use-after-free in do_getline_redir() in io.c (redir_exp dereferenced after being freed)
• CVE-2026-40553: fix stack buffer overflow in ftype() in the readdir extension (unbounded path concatenation before stat())
• CVE-2026-40469: fix integer overflow in do_sub() in builtin.c (64-bit overflow check on the result-buffer size prevents heap corruption in sub/gsub/gensub replacement expansion on 32-bit builds)

• CVE-2026-40468: fix integer overflows in do_sub() in builtin.c and parse_escape() in node.c (sofar widened to size_t, escape accumulator widened to int64_t to avoid overflow on 32-bit builds)

Use after free in gawk. (CVE-2026-40467) Heap buffer overflow in gawk. (CVE-2026-40468) Heap buffer overflow in gawk. (CVE-2026-40469) Stack-based buffer overflow in gawk. (CVE-2026-40553)

This update for gawk fixes the following issues:

• CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash (bsc#1271351).
• CVE-2026-40468: use-after-free vulnerability in gawk's "io.c" file could permit heap metadata manipulation and host memory exhaustion (bsc#1271352).
• CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash (bsc#1271354).

This update for gawk fixes the following issues:

• CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash (bsc#1271351).
• CVE-2026-40468: use-after-free vulnerability in gawk's "io.c" file could permit heap metadata manipulation and host memory exhaustion (bsc#1271352).
• CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash (bsc#1271354).

This update for gawk fixes the following issues:

• CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash (bsc#1271351).
• CVE-2026-40468: use-after-free vulnerability in gawk's "io.c" file could permit heap metadata manipulation and host memory exhaustion (bsc#1271352).
• CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash (bsc#1271354).

This update for gawk fixes the following issues

• CVE-2026-40467: use-after-free in the io.c program file via the do_getline_redir() routine (bsc#1271351).
• CVE-2026-40468: integer overflow in the builtin.c program file (bsc#1271352).
• CVE-2026-40553: buffer overflow in the extension/readdir.c program file via the ftype() routine (bsc#1271354).

This update for gawk fixes the following issue:

• CVE-2026-40468: integer overflow in the builtin.c program file (bsc#1271352).

This update for gawk fixes the following issues:

• CVE-2026-40467: use-after-free in the io.c program file via the do_getline_redir() routine (bsc#1271351).
• CVE-2026-40468: integer overflow in the builtin.c program file (bsc#1271352).
• CVE-2026-40553: buffer overflow in the extension/readdir.c program file via the ftype() routine (bsc#1271354).

It was discovered that Gawk incorrectly handled memory when processing input using the getline redirection. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-40467)

It was discovered that Gawk incorrectly handled certain integer calculations when allocating memory. An attacker could possibly use this issue to cause a denial of service or overwrite heap memory with attacker-controlled data. (CVE-2026-40468)

It was discovered that Gawk incorrectly handled certain integer calculations when performing substitutions. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-40469)

It was discovered that Gawk incorrectly handled memory when reading directory entries. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-40553)