Executive brief
A vulnerability exists in gawk, a widely used tool for processing text files on Linux and Unix systems. An attacker could use a specially crafted script to cause the tool to consume all available system memory or corrupt its internal data. This could lead to system instability or allow an attacker to interfere with the program's normal operation.
Technical details
An integer overflow vulnerability (CWE-190) exists in the 'builtin.c' file of GNU gawk, specifically within the 'do_sub' routine. The root cause is the use of a signed integer for the 'sofar' variable, which tracks processed data; this can be triggered during string substitution operations. A local attacker can exploit this by providing malicious input that causes the integer to wrap, leading to excessive memory allocation (memory exhaustion) or the overwriting of heap metadata and objects with attacker-controlled bytes. The vulnerability is fixed in gawk version 5.4.1 by changing the variable type to size_t.
Affected products
- GNU gawk 5.4.0 and below
Timeline
- 2026-04-04: patched: Initial fix committed to repository
- 2026-07-13: disclosed: Public disclosure by CERT Polska
- 2026-07-13: advisory: NVD entry published