CVE-2026-56392 is a heap-based buffer overflow vulnerability in the unexpand utility of GNU coreutils. The flaw arises from an integer overflow when unexpand processes unusually large tab stop values provided by a local attacker, leading to an undersized memory buffer. Subsequent operations may write beyond the buffer boundaries, causing memory corruption. Successful exploitation can cause the utility to crash (denial of service) or potentially allow arbitrary memory manipulation. Red Hat has identified this as a moderate impact issue with no current fix meeting their standards for deployment and stability. The affected packages include coreutils-9.11-5.hum1 for aarch64 and x86_64 architectures in Red Hat Hardened Images.

The vulnerability allows a local attacker to cause a denial of service by crashing the unexpand utility through crafted input with large tab stop values. Additionally, memory corruption could potentially be exploited for further memory manipulation, including modifying control data or executing unauthorized code. However, no known exploits are reported in the wild. The impact is rated medium by Red Hat, reflecting the local attack vector and the requirement for user interaction.

Currently, there is no available fix or mitigation that meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is released, avoid running untrusted or crafted inputs through the unexpand utility. Red Hat customers with a Technical Account Manager (TAM) can consult directly for guidance.