Home

Description

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

PUBLISHED Reserved 2026-04-13 | Published 2026-07-13 | Updated 2026-07-13 | Assigner CERT-PL




LOW: 2.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L

Problem types

CWE-190 Integer Overflow or Wraparound

Product status

Default status
unaffected

Any version
affected

Credits

Michał Majchrowicz (AFINE) finder

Marcin Wyczechowski (AFINE) finder

References

cgit.git.savannah.gnu.org/...1b991362c046f7f2e238ffa34e6f8c7 patch

cert.pl/en/posts/2026/07/CVE-2026-40467 third-party-advisory

cve.org (CVE-2026-40468)

nvd.nist.gov (CVE-2026-40468)

Download JSON