The vulnerability (CVE-2026-40553) is a stack-based buffer overflow in the ftype() routine of gawk, located in extension/readdir.c. This flaw can be triggered by processing untrusted input, potentially leading to denial of service via program crash or possibly arbitrary code execution, though the latter is not confirmed. The vulnerability affects multiple versions of gawk distributed with Red Hat Hardened Images RPMs. Red Hat has issued security updates including gawk-5.4.0-3.1.hum1 packages for affected architectures. The vulnerability is rated moderate severity due to the requirement for user interaction and the nature of the impact. Mitigation includes avoiding running gawk on untrusted scripts or files. Red Hat's memory protections provide some defense by crashing the program to prevent exploitation.

Successful exploitation can cause denial of service by crashing the gawk program. There is a potential, but unconfirmed, risk of arbitrary code execution. The vulnerability requires local user interaction with specially crafted input to trigger. Red Hat classifies the impact as moderate, with high availability impact (program crash) but no confirmed confidentiality or integrity impact.

Red Hat recommends not running gawk against untrusted scripts, files, or directories to prevent exploitation. The vendor has released updated RPM packages (gawk-5.4.0-3.1.hum1) that address this vulnerability. Users should apply these updates as soon as possible. Red Hat's built-in memory protections help mitigate the risk by safely crashing the program if an attack is attempted, preventing code execution. No additional mitigations are specified.