CVE-2026-40469 Details
Description
Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.
An integer overflow vulnerability has been identified in the 'builtin.c' file of GNU Gawk, specifically within the 'do_sub()' function. This vulnerability affects 32-bit builds of Gawk in all versions through 5.4.0. The issue arises from improper handling of string replacement operations, which can lead to memory exhaustion on the hosting operating system. Exploitation of this vulnerability allows for the overwriting of Gawk's heap metadata and objects with attacker-controlled data, potentially causing the program to crash.
Users can upgrade to GNU Gawk version 5.4.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2026/07/CVE-2026-40467 | [email protected] | Third Party Advisory |
| https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b | [email protected] | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fossies gawk | <= 5.4.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |