CVE-2026-40469
Published: July 16, 2026Last modified: July 17, 2026
Description
Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.1 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | HIGH |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 25 LTS | gawk | Fixed (5.3.2-r3) |
| Stream | gawk | Fixed (5.3.2-r3) | |
| Hardened Containers | 25 LTS | gawk | Fixed (5.3.2-r3) |
| Stream | gawk | Fixed (5.3.2-r3) |