Is CVE-2026-40553 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40553 being exploited in the wild.

How severe is CVE-2026-40553?

Informational severity, with a CVSS score of 5.1, published 13 July 2026.

Is there a fix for CVE-2026-40553?

A patch was published on 2026-04-15: Fix committed to gawk repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40553 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40553?

Check whether you run Gnu Gawk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40553: GNU gawk stack buffer overflow in readdir extension

CVE-2026-40553 · Severity: info · CVSS 5.1 · Published 2026-07-13

A security vulnerability exists in gawk, a widely used tool for processing text and data on Linux and Unix-like systems. An attacker could exploit this flaw to cause the program to crash or potentially run unauthorized commands. This could disrupt automated data processing tasks or allow an attacker to gain further access to a system where they already have a local presence.

Technologies: Gnu Gawk. Vendors: Gnu.

Quick answers

Is CVE-2026-40553 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40553 being exploited in the wild.
How severe is CVE-2026-40553?: Informational severity, with a CVSS score of 5.1, published 13 July 2026.
Which products and versions are affected?: Gnu Gawk 5.4.0 and below.
Is there a fix for CVE-2026-40553?: A patch was published on 2026-04-15: Fix committed to gawk repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40553 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40553?: Check whether you run Gnu Gawk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the 'extension/readdir.c' component of GNU gawk within the ftype() routine. The vulnerability is caused by the use of sprintf() to concatenate a directory name and a filename into a fixed-size buffer of PATH_MAX length without bounds checking. A local attacker can trigger this overflow by providing a directory structure with a combined path length exceeding PATH_MAX. While primarily leading to a denial-of-service (crash), arbitrary code execution may be possible, though it has not been confirmed. The issue is fixed in gawk version 5.4.1 by replacing sprintf() with snprintf() and implementing explicit length validation.

Affected products

GNU gawk 5.4.0 and below

Timeline

2026-04-15: patched: Fix committed to gawk repository
2026-07-13: disclosed: Public disclosure by CERT Polska
2026-07-13: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.