CVE-2026-40468lowCWE-190

CVE-2026-40468: low-severity vulnerability in GNU gawk

Heap buffer overflow in gawk

Published

Follow this CVE+ Monitor gawk+ Monitor gawk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.1epss 0.2%
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L
Affected products
GNU · gawk
Related CVEs — GNU gawk

In the same product, most dangerous first.

CVE-2026-40553MEDIUMStack-based buffer overflow in gawkEPSS 0.3%CVE-2026-40469MEDIUMHeap buffer overflow in gawkEPSS 0.2%CVE-2026-40467MEDIUMUse after free in gawkEPSS 0.2%