Executive brief
A security vulnerability exists in gawk, a widely used tool for processing text and data on Linux and Unix-like systems. An attacker could exploit this flaw to cause the program to crash or potentially run unauthorized commands. This could disrupt automated data processing tasks or allow an attacker to gain further access to a system where they already have a local presence.
Technical details
A stack-based buffer overflow (CWE-121) exists in the 'extension/readdir.c' component of GNU gawk within the ftype() routine. The vulnerability is caused by the use of sprintf() to concatenate a directory name and a filename into a fixed-size buffer of PATH_MAX length without bounds checking. A local attacker can trigger this overflow by providing a directory structure with a combined path length exceeding PATH_MAX. While primarily leading to a denial-of-service (crash), arbitrary code execution may be possible, though it has not been confirmed. The issue is fixed in gawk version 5.4.1 by replacing sprintf() with snprintf() and implementing explicit length validation.
Affected products
- GNU gawk 5.4.0 and below
Timeline
- 2026-04-15: patched: Fix committed to gawk repository
- 2026-07-13: disclosed: Public disclosure by CERT Polska
- 2026-07-13: advisory: NVD record published