CVE-2026-40468: Heap buffer overflow in gawk
Published Jul 13, 2026
·Updated
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.
Affected Software
3 affected components
GNU gawk<=5.4.0
Fossies Gawk<=5.4.0
debian/gawk<=1:5.1.0-1, <=1:5.2.1-2, <=1:5.3.2-1
Event History
Jul 13, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
DescriptionWeakness
Data Sourced
via NVD·01:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 22, 2026
Data Sourced
via Ubuntu·08:18 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·08:20 PM
DescriptionAffected Software
Data Sourced
via Launchpad·08:20 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-40468?
The severity of CVE-2026-40468 is classified as low with a CVSS score of 4.0.
2
How do I fix CVE-2026-40468?
To fix CVE-2026-40468, update gawk to version 5.4.1 or higher.
3
What causes CVE-2026-40468?
CVE-2026-40468 is caused by an integer overflow vulnerability in the 'builtin.c' file of gawk.
4
What systems are affected by CVE-2026-40468?
CVE-2026-40468 affects gawk versions 5.4.0 and below.
5
What are the potential impacts of CVE-2026-40468?
The potential impacts of CVE-2026-40468 include memory exhaustion and the possibility of overwriting gawk heap metadata.