Executive brief
A vulnerability exists in the 'unexpand' utility of GNU coreutils, a standard set of basic file and text manipulation tools used in Linux and Unix-like systems. By providing a specially crafted command-line argument for tab stops, an attacker can cause the program to crash or potentially execute unauthorized actions. This could lead to a disruption of service or a security breach on systems where this utility processes untrusted input.
Technical details
A heap-based buffer overflow exists in the GNU coreutils 'unexpand' utility. The vulnerability is caused by an integer overflow during memory allocation when the program processes large tab stop values provided via the '-t' command-line argument. Specifically, a multiplication operation used to calculate the required buffer size can wrap around, resulting in an undersized heap allocation. Subsequent write operations then exceed the buffer boundaries. An attacker who can control the arguments passed to 'unexpand' can trigger a crash or potentially achieve a heap write primitive. The issue has been addressed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d.
Affected products
- GNU coreutils All through 9.11
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory