CVE-2026-40469

CRITICAL CVSS 9.1 View on NVD ↗

Description

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected Products

fossies/gawk

References

https://cert.pl/en/posts/2026/07/CVE-2026-40467
https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b

Published: Jul 13, 2026 13:16 UTC Modified: Jul 14, 2026 01:11 UTC