Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-40553 is a buffer overflow vulnerability found in the ftype() routine of the gawk utility, specifically in the extension/readdir.c source file. This vulnerability can be triggered by processing untrusted input, potentially causing a denial of service via program crash or possibly arbitrary code execution. The vulnerability is rated moderate severity by Red Hat because exploitation requires local access and user interaction. Red Hat has released updated RPM packages for gawk (version 5.4.0-3.1.hum1) for affected architectures (aarch64, x86_64) as part of the Red Hat Hardened Images security update. The advisory notes that Red Hat's built-in memory protections help prevent code execution by crashing the program safely if an attack is attempted.

Successful exploitation can cause denial of service by crashing the gawk program. There is also a potential for arbitrary code execution, although this has not been definitively confirmed. The vulnerability requires local access and user interaction with specially crafted files or directories. No remote exploitation is possible. The impact is limited to availability and potentially integrity if code execution occurs.

Red Hat has released updated gawk RPM packages (version 5.4.0-3.1.hum1) that address this vulnerability. Users should apply these updates to remediate the issue. Until patched, users should avoid running gawk on untrusted scripts, files, or directories to prevent triggering the vulnerability. Red Hat's built-in memory protections provide some mitigation by safely crashing the program if exploitation is attempted.