CVE-2026-56391: CWE-125 Out-of-bounds Read in GNU coreutils
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
AI Analysis
Technical Summary
CVE-2026-56391 is an out-of-bounds read vulnerability in GNU coreutils uniq 9.5 caused by improper handling of multibyte input in the find_field() function when the -w option is used. The function miscalculates character byte lengths by not advancing the pointer correctly, leading to an inflated length used in memory comparison operations. This flaw can cause the program to read beyond allocated memory buffers, potentially causing a crash and exposing adjacent heap memory. The issue has been fixed in commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Potential Impact
An attacker providing crafted multibyte input to GNU coreutils uniq with the -w option can trigger an out-of-bounds read, leading to a program crash and possible exposure of adjacent heap memory contents. This may allow limited information disclosure but does not indicate code execution or privilege escalation.
Mitigation Recommendations
A fix for this vulnerability is available and has been committed (commit d64e35a8a4c0e4608321433e0d84d917e4e36371). Users should update GNU coreutils uniq to a version that includes this fix. Patch status is not explicitly stated in the input data, so verify the vendor advisory or source repository for the fixed version and apply the update accordingly.
CVE-2026-56391: CWE-125 Out-of-bounds Read in GNU coreutils
Description
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
CVSS v4.0
Score 4.6medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56391 is an out-of-bounds read vulnerability in GNU coreutils uniq 9.5 caused by improper handling of multibyte input in the find_field() function when the -w option is used. The function miscalculates character byte lengths by not advancing the pointer correctly, leading to an inflated length used in memory comparison operations. This flaw can cause the program to read beyond allocated memory buffers, potentially causing a crash and exposing adjacent heap memory. The issue has been fixed in commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Potential Impact
An attacker providing crafted multibyte input to GNU coreutils uniq with the -w option can trigger an out-of-bounds read, leading to a program crash and possible exposure of adjacent heap memory contents. This may allow limited information disclosure but does not indicate code execution or privilege escalation.
Mitigation Recommendations
A fix for this vulnerability is available and has been committed (commit d64e35a8a4c0e4608321433e0d84d917e4e36371). Users should update GNU coreutils uniq to a version that includes this fix. Patch status is not explicitly stated in the input data, so verify the vendor advisory or source repository for the fixed version and apply the update accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-06-21T11:40:32.790Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6320db9c2644c7f8989ba4
Added to database: 07/24/2026, 08:22:51 UTC
Last enriched: 07/24/2026, 08:37:23 UTC
Last updated: 07/24/2026, 21:43:11 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.