CVE-2026-40469: Heap buffer overflow in gawk
Integer overflow vulnerability has been found in "builtin.c" program file of gawk (dosub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40469?
CVE-2026-40469 has a medium severity rating of 5.1 according to the CVSS.
How does CVE-2026-40469 affect gawk?
CVE-2026-40469 affects 32-bit builds of gawk version 5.4.0 and below, allowing an integer overflow that can overwrite heap metadata.
How do I fix CVE-2026-40469?
To mitigate CVE-2026-40469, upgrade gawk to a version above 5.4.0 or apply relevant patches.
What type of vulnerability is CVE-2026-40469?
CVE-2026-40469 is classified as an integer overflow vulnerability leading to a heap buffer overflow.
What component of gawk is affected by CVE-2026-40469?
CVE-2026-40469 specifically affects the 'builtin.c' program file in the do_sub() routine of gawk.