# CVE-2026-40468: GNU gawk integer overflow in builtin.c

Source: https://junglewise.ai/threats/cve-2026-40468-gnu-gawk-integer-overflow-in-builtin-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-40468 · Severity: info · CVSS 2.1 · Published 2026-07-13

A vulnerability exists in gawk, a widely used tool for processing text files on Linux and Unix systems. An attacker could use a specially crafted script to cause the tool to consume all available system memory or corrupt its internal data. This could lead to system instability or allow an attacker to interfere with the program's normal operation.

Technologies: [Gnu Gawk](https://junglewise.ai/threats/technologies/gawk). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-40468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40468 being exploited in the wild.

**How severe is CVE-2026-40468?** Informational severity, with a CVSS score of 2.1, published 13 July 2026.

**Which products and versions are affected?** Gnu Gawk 5.4.0 and below.

**Is there a fix for CVE-2026-40468?** A patch was published on 2026-04-04: Initial fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40468 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-40468?** Check whether you run Gnu Gawk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability (CWE-190) exists in the 'builtin.c' file of GNU gawk, specifically within the 'do_sub' routine. The root cause is the use of a signed integer for the 'sofar' variable, which tracks processed data; this can be triggered during string substitution operations. A local attacker can exploit this by providing malicious input that causes the integer to wrap, leading to excessive memory allocation (memory exhaustion) or the overwriting of heap metadata and objects with attacker-controlled bytes. The vulnerability is fixed in gawk version 5.4.1 by changing the variable type to size_t.

## Affected products

- GNU gawk 5.4.0 and below

## Timeline

- 2026-04-04: patched: Initial fix committed to repository
- 2026-07-13: disclosed: Public disclosure by CERT Polska
- 2026-07-13: advisory: NVD entry published

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-40467](https://cert.pl/en/posts/2026/07/CVE-2026-40467)
- [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7](https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7)

## Related threats

- [GNU gawk stack buffer overflow in readdir extension](https://junglewise.ai/threats/cve-2026-40553-gnu-gawk-stack-buffer-overflow-in-readdir-extension)
- [GNU gawk integer overflow in do_sub routine](https://junglewise.ai/threats/cve-2026-40469-gnu-gawk-integer-overflow-in-do-sub-routine)
- [GNU gawk Use After Free in do_getline_redir](https://junglewise.ai/threats/cve-2026-40467-gnu-gawk-use-after-free-in-do-getline-redir)