Threats Tagged 'cve-2026-40469'

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs. Security Fix(es): * gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468) * gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A buffer overflow vulnerability exists in the ftype() routine of gawk, part of Red Hat Hardened Images RPMs. This flaw could allow an attacker to crash the program, causing a denial of service, and may potentially lead to arbitrary code execution, although this has not been definitively confirmed. Exploitation requires local user interaction with specially crafted files. Red Hat has issued an update including gawk version 5.4.0-3.1.hum1 to address this issue.

This update includes the following RPMs: gawk: * gawk-5.4.0-3.1.hum1 (aarch64, x86_64) * gawk-all-langpacks-5.4.0-3.1.hum1 (aarch64, x86_64) * gawk-devel-5.4.0-3.1.hum1 (aarch64, x86_64) * gawk-doc-5.4.0-3.1.hum1 (noarch) * gawk-5.4.0-3.1.hum1.src (src) Security Fix(es): gawk: * CVE-2026-40553

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.