CVE-2026-56392 is a heap-based buffer overflow vulnerability in GNU coreutils unexpand. The flaw arises from an integer overflow during the calculation of buffer allocation size for large tab stop (-t) values. This overflow causes the allocated buffer to be smaller than intended, allowing subsequent writes to exceed the allocated memory bounds. When unexpand processes attacker-controlled large tab stop arguments, it can lead to a crash and potentially enable exploitation via heap memory corruption. The vulnerability has been fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d.

The vulnerability can cause unexpand to crash due to out-of-bounds heap writes. Depending on the memory layout, it may allow an attacker to achieve a heap write primitive, which could be leveraged for further exploitation. The CVSS 4.0 base score is low (1.8), reflecting limited attack vector and impact.

A fix for this vulnerability has been committed by the GNU project (commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d). Users should update to the patched version of GNU coreutils once it is released. Patch status is not yet confirmed in the advisory; check the vendor's official releases for the fixed version. Until then, avoid processing untrusted input with large tab stop (-t) values in unexpand.