Quick answers
- Is CVE-2026-40469 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40469 being exploited in the wild.
- How severe is CVE-2026-40469?
- Informational severity, with a CVSS score of 5.1, published 13 July 2026.
- Which products and versions are affected?
- Gnu Gawk All versions through 5.4.0 (32-bit builds).
- Is there a fix for CVE-2026-40469?
- A patch was published on 2026-04-06: Fix committed to gawk repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40469 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-40469?
- Check whether you run Gnu Gawk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow vulnerability exists in the 'do_sub()' routine within 'builtin.c' of GNU gawk. The flaw occurs during the calculation of the result buffer size for string substitution functions (sub, gsub, gensub) when processing large replacement expansions. On 32-bit systems, this calculation can wrap around, leading to heap metadata and object corruption. An attacker who can control the input strings and replacement patterns passed to these functions can trigger a crash (denial of service). The issue was addressed in version 5.4.1 by performing the size calculation using 64-bit integers and implementing explicit overflow checks.
Affected products
- GNU gawk All versions through 5.4.0 (32-bit builds)
Timeline
- 2026-04-06: patched: Fix committed to gawk repository
- 2026-07-13: disclosed: Public disclosure by CERT Polska and NVD publication