Vulnerabilities in GNU gawk software

CERT Polska has received a report about vulnerabilities in GNU gawk software and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-40467: Use After Free vulnerability has been found inio.cprogram file of gawk (do_getline_redir()routine). This issue may lead to a crash.

The vulnerabilityCVE-2026-40468: Integer overflow vulnerability has been found inbuiltin.cprogram file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes.

The vulnerabilityCVE-2026-40469: Integer overflow vulnerability has been found inbuiltin.cprogram file of gawk (do_sub()routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk.

The vulnerabilityCVE-2026-40553: Buffer overflow vulnerability has been found inextension/readdir.cprogram file of gawk (ftype()routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible.

These vulnerabilities were fixed in release 5.4.1 of gawk.

We thank Michał Majchrowicz and Marcin Wyczechowski (AFINE) for the responsible vulnerability report.