CVE-2026-40553: Stack-based buffer overflow in gawk
Published Jul 13, 2026
·Updated
Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.
Affected Software
3 affected components
GNU gawk<=5.4.0
Fossies Gawk<=5.4.0
debian/gawk<=1:5.1.0-1, <=1:5.2.1-2, <=1:5.3.2-1
Event History
Jul 13, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
DescriptionWeakness
Data Sourced
via NVD·01:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 22, 2026
Data Sourced
via Ubuntu·08:18 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·08:20 PM
DescriptionAffected Software
Data Sourced
via Launchpad·08:20 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-40553?
The severity of CVE-2026-40553 is rated as medium with a CVSS score of 5.1.
2
How do I fix CVE-2026-40553?
To fix CVE-2026-40553, update to gawk version 5.4.1 or later.
3
What type of vulnerability is CVE-2026-40553?
CVE-2026-40553 is a buffer overflow vulnerability found in the gawk software.
4
What impact can CVE-2026-40553 have on my system?
CVE-2026-40553 can potentially crash the gawk program and may allow for code execution, although this has not been confirmed.
5
Which versions of gawk are affected by CVE-2026-40553?
CVE-2026-40553 affects gawk versions 5.4.0 and below.