Quick answers
- Is CVE-2026-40468 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40468 being exploited in the wild.
- How severe is CVE-2026-40468?
- Informational severity, with a CVSS score of 2.1, published 13 July 2026.
- Which products and versions are affected?
- Gnu Gawk 5.4.0 and below.
- Is there a fix for CVE-2026-40468?
- A patch was published on 2026-04-04: Initial fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40468 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-40468?
- Check whether you run Gnu Gawk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow vulnerability (CWE-190) exists in the 'builtin.c' file of GNU gawk, specifically within the 'do_sub' routine. The root cause is the use of a signed integer for the 'sofar' variable, which tracks processed data; this can be triggered during string substitution operations. A local attacker can exploit this by providing malicious input that causes the integer to wrap, leading to excessive memory allocation (memory exhaustion) or the overwriting of heap metadata and objects with attacker-controlled bytes. The vulnerability is fixed in gawk version 5.4.1 by changing the variable type to size_t.
Affected products
- GNU gawk 5.4.0 and below
Timeline
- 2026-04-04: patched: Initial fix committed to repository
- 2026-07-13: disclosed: Public disclosure by CERT Polska
- 2026-07-13: advisory: NVD entry published