CVE-2026-40469

Critical · CVSS 9.1

gawk — Integer overflow leading to heap metadata corruption

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-190

Description

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.

Search profile — drives PoC discovery

Symbols builtin.cdo_subdo_sub()gawk heap metadatainteger overflow

Keywords CVE-2026-40469gawkinteger overflowdo_subbuiltin.cheap corruption32-bitgawk 5.4.0CWE-190

Versions: <= 5.4.0 (32-bit builds)

References

https://cert.pl/en/posts/2026/07/CVE-2026-40467
https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b

Status: enriched · ingested 2026-07-14T06:00:21.000Z · profiled 2026-07-14T06:30:21.000Z