Executive brief
A vulnerability exists in gawk, a widely used data processing tool, specifically affecting 32-bit systems. An attacker could provide specially crafted input to trigger a program crash by overflowing internal memory calculations. This can lead to service disruptions or instability in automated scripts and data processing pipelines.
Technical details
An integer overflow vulnerability exists in the 'do_sub()' routine within 'builtin.c' of GNU gawk. The flaw occurs during the calculation of the result buffer size for string substitution functions (sub, gsub, gensub) when processing large replacement expansions. On 32-bit systems, this calculation can wrap around, leading to heap metadata and object corruption. An attacker who can control the input strings and replacement patterns passed to these functions can trigger a crash (denial of service). The issue was addressed in version 5.4.1 by performing the size calculation using 64-bit integers and implementing explicit overflow checks.
Affected products
- GNU gawk All versions through 5.4.0 (32-bit builds)
Timeline
- 2026-04-06: patched: Fix committed to gawk repository
- 2026-07-13: disclosed: Public disclosure by CERT Polska and NVD publication