CVE-2026-40469

EUVD-2026-43494
Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.93%
Affected Products (NVD)
VendorProductVersion
fossiesgawk
𝑥
≤ 5.4.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gawk
bookworm
vulnerable
bullseye
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gawk
bionic
Fixed 1:4.1.4+dfsg-1ubuntu0.1~esm2
released
focal
Fixed 1:5.0.1+dfsg-1ubuntu0.1+esm1
released
jammy
Fixed 1:5.1.0-1ubuntu0.2
released
noble
Fixed 1:5.2.1-2ubuntu0.1
released
resolute
Fixed 1:5.3.2-1ubuntu1.1
released
trusty
Fixed 1:4.0.1+dfsg-2.1ubuntu2+esm2
released
xenial
Fixed 1:4.1.3+dfsg-0.1ubuntu0.1~esm2
released