CVE-2026-40469 Detail

Nvd.Nist • July 14, 2026

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in GNU gawk Software CERT Polska reported several vulnerabilities in GNU gawk software, including CVE-2026-40467, CVE-2026-40468, CVE-2026-40469, and CVE-2026-40553. The vulnerabilities include a use-after-free issue, integer overflows, and a buffer overflow, primarily affecting 32-bit builds of gawk. These vulnerabilities could lead to crashes and potential code execution, although the latter remains unconfirmed. All identified vulnerabilities were fixed in release 5.4.1 of gawk. The vulnerabilities were disclosed on July 13, 2026, and affected versions include 5.4.0 and below. CERT Polska acknowledged the responsible reporting by Michał Majchrowicz and Marcin Wyczechowski from AFINE. 5 sources 58

Extracted Entities

CVE-2026-40469 Detail

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)