Every CVE Search/ Get API key

CVE-2026-56391

Out‑of‑bounds Read in GNU coreutils

4.6 MediumFix available

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.13%Unchanged since Jul 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.6

Out‑of‑bounds Read in GNU coreutils

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
CVE-2026-56391
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-48524 4.6

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
EUVD-2026-48524
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7xvj-m9x7-qgxq 4.6

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte...

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
GHSA-7xvj-m9x7-qgxq
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 4.6

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
CVE-2026-56391
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 4.6

Out‑of‑bounds Read in GNU coreutils

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
CVE-2026-56391
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-07
OSVDEBIAN-CVE-2026-56391 6.1

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
DEBIAN-CVE-2026-56391
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVJLSEC-2026-1195 4.6

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte...

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
JLSEC-2026-1195
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:46515 6.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:46515
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:67886 6.1

Red Hat Security Advisory: coreutils security update

Record
RHSA-2026:67886
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:67886 6.1

Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

  • coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input (CVE-2026-56391)

  • coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67886
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56391 4.6

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Record
UBUNTU-CVE-2026-56391
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:67886 No score

Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.

Security Fix(es):

  • coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input (CVE-2026-56391)
  • coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67886
Updated
2026-11-02
OSVMGASA-2026-0439 No score

Updated coreutils package fixes a security vulnerability

Out‑of‑bounds Read in GNU coreutils. (CVE-2026-56391)

Record
MGASA-2026-0439
Updated
2026-11-02
OSVopenSUSE-SU-2026:11764-1 No score

coreutils-9.11-5.1 on GA media

These are all security issues fixed in the coreutils-9.11-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11764-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22147-1 No score

Security update for coreutils

This update for coreutils fixes the following issue:

  • CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input (bsc#1272698).
Record
openSUSE-SU-2026:22147-1
Updated
2026-11-02
OSVSUSE-SU-2026:24268-1 No score

Security update for coreutils

This update for coreutils fixes the following issue:

  • CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input (bsc#1272698).
Record
SUSE-SU-2026:24268-1
Updated
2026-11-02
OSVSUSE-SU-2026:24406-1 No score

Security update for coreutils

This update for coreutils fixes the following issue:

  • CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input (bsc#1272698).
Record
SUSE-SU-2026:24406-1
Updated
2026-11-02
OSVUSN-8697-1 No score

coreutils vulnerabilities

It was discovered that GNU Core Utilities sort had a heap buffer under-read in its begfield() function. A local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial of service, or obtain sensitive information. (CVE-2025-5278)

It was discovered that GNU Core Utilities uniq had an out-of-bounds read when the -w option was used with crafted multibyte input. A local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-56391)

Record
USN-8697-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
coreutils
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.5-8.el10_2.1
9.5-8.el10_2.1
coreutils-common
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.5-8.el10_2.1
9.5-8.el10_2.1
coreutils-single
AlmaLinux:10
From an advisory covering 2 CVEs
 before 9.5-8.el10_2.1
9.5-8.el10_2.1
coreutils
Debian:12
 All versions, plus listed versions
9.1-19.10-19.4-19.4-29.4-3
Show 7 moreShow less
9.4-3.19.5-19.6-19.6-29.7-19.7-29.7-3
 None known
coreutils
Debian:13
 All versions, plus listed versions
9.10-19.7-3
 None known
coreutils
Debian:14
 All versions, plus listed versions
9.10-19.7-3
 None known
coreutils_jll
Julia
 9.5.0+0 and later None known
coreutils
Mageia:10
 before 9.8-3.mga10
9.8-3.mga10
coreutils
Red Hat:hummingbird:1
 before 0:9.11-5.1.hum1
0:9.11-5.1.hum1
coreutils-common
Red Hat:hummingbird:1
 before 0:9.11-5.1.hum1
0:9.11-5.1.hum1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
coreutils-single
Red Hat:hummingbird:1
 before 0:9.11-5.1.hum1
0:9.11-5.1.hum1
coreutils
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.5-8.el10_2.1
0:9.5-8.el10_2.1
coreutils-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.5-8.el10_2.1
0:9.5-8.el10_2.1
coreutils-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.5-8.el10_2.1
0:9.5-8.el10_2.1
coreutils-single
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.5-8.el10_2.1
0:9.5-8.el10_2.1
coreutils-single-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:9.5-8.el10_2.1
0:9.5-8.el10_2.1
coreutils
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:9.5-8.el10_2.1
0:9.5-8.el10_2.1
coreutils
SUSE:Linux Enterprise Server 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-single
SUSE:Linux Enterprise Server 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-systemd
SUSE:Linux Enterprise Server 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-single
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-systemd
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils
SUSE:Linux Micro 6.2
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-systemd
SUSE:Linux Micro 6.2
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils
Ubuntu:26.04:LTS
 before 9.7-3ubuntu2.1, plus listed versions
9.5-1ubuntu49.7-3ubuntu19.7-3ubuntu2
9.7-3ubuntu2.1
coreutils
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 8.32-4.1ubuntu1.4, plus listed versions
8.32-4ubuntu28.32-4ubuntu38.32-4.1ubuntu18.32-4.1ubuntu1.18.32-4.1ubuntu1.28.32-4.1ubuntu1.3
8.32-4.1ubuntu1.4
coreutils
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 9.4-3ubuntu6.3, plus listed versions
9.1-1ubuntu29.4-2ubuntu19.4-2ubuntu29.4-2ubuntu39.4-2ubuntu4
Show 5 moreShow less
9.4-3ubuntu39.4-3ubuntu59.4-3ubuntu69.4-3ubuntu6.19.4-3ubuntu6.2
9.4-3ubuntu6.3
coreutils
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 9.7-3ubuntu2.1, plus listed versions
9.5-1ubuntu49.7-3ubuntu19.7-3ubuntu2
9.7-3ubuntu2.1
coreutils
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 9.11-5.1
9.11-5.1
coreutils
openSUSE:Leap 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-single
openSUSE:Leap 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-systemd
openSUSE:Leap 16.0
 before 9.6-160000.3.1
9.6-160000.3.1
coreutils-testsuite
openSUSE:Leap 16.0
 before 9.6-160000.3.1
9.6-160000.3.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, products, published, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56391 is a medium vulnerability (CVSS 4.6) in Gnu Coreutils, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in coreutils 9.8-3.mga10.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open