by Kastro
Paper/Archive/CVE-2026-40468

CVE-2026-40468

GNU gawk — Heap buffer overflow in gawk

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
29
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 10.0.100 × 202.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

Affected

ProductAffectedFixed inSource
gawk≤ 5.4.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CERT-PL (CNA)2.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

patchcgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7writeupcert.pl/en/posts/2026/07/CVE-2026-40467