Skip to main content
CVE-2026-56392VulnerabilityPublished 09/10/2026Updated 10/12/2026

Red Hat Security Advisory: coreutils security update

Affects Red Hat Product Security Red HatSource GCVE Database

0
Authoritative record:CVE-2026-56392· Low 1.8

Not known to be exploited · CVSS 1.8 Low.

Data as of 10/25/2026, 09:04:00 UTC

CVSS base score
1.8Low
How severe the flaw is on the 0–10 CVSS scale.
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

What to do

Affected software

ProductAffectedFixed in
Red Hat Product Security Red HatAffected
  • =8.30-20.el8_10
  • Red Hat
  • Red Hat Hardened Images
  • aarch64
  • coreutils-main@aarch64
  • Red Hat Enterprise Linux
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • ppc64le
  • coreutils-0:8.30-20.el8_10.ppc64le
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • src
  • coreutils-0:8.32-41.el9_8.1.src
  • coreutils-0:9.11-5.hum1@aarch64
Fixed in–

AI-suggested

Currently, there is no available fix or mitigation that meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is released, avoid running untrusted or crafted inputs through the unexpand utility. Red Hat customers with a Technical Account Manager (TAM) can consult directly for guidance.

Description

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write. When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout. This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

Impact

The vulnerability allows a local attacker to cause a denial of service by crashing the unexpand utility through crafted input with large tab stop values. Additionally, memory corruption could potentially be exploited for further memory manipulation, including modifying control data or executing unauthorized code. However, no known exploits are reported in the wild. The impact is rated medium by Red Hat, reflecting the local attack vector and the requirement for user interaction.

Summary

CVE-2026-56392 is a heap-based buffer overflow vulnerability in the unexpand utility of GNU coreutils. The flaw arises from an integer overflow when unexpand processes unusually large tab stop values provided by a local attacker, leading to an undersized memory buffer. Subsequent operations may write beyond the buffer boundaries, causing memory corruption. Successful exploitation can cause the utility to crash (denial of service) or potentially allow arbitrary memory manipulation. Red Hat has identified this as a moderate impact issue with no current fix meeting their standards for deployment and stability. The affected packages include coreutils-9.11-5.hum1 for aarch64 and x86_64 architectures in Red Hat Hardened Images.

Weaknesses

  • CWE-787Out-of-bounds Write (opens in a new tab)

    Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5

    The product writes data past the end, or before the beginning, of the intended buffer.

  • CWE-122Heap-based Buffer Overflow (opens in a new tab)

    Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #16

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

Community reviews

Loading reviews…