CVE catalog

CVE-2026-40468

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap met

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.20% · Oct 25, 2026

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangawksid1:5.3.2-1vulnerable
Debiangawkforky1:5.3.2-1vulnerable
Debiangawktrixie1:5.2.1-2vulnerable
Debiangawkbookworm1:5.2.1-2vulnerable
CpegawkNot reportedNot reportedvulnerable
Ubuntugawknoble1:5.2.1-2ubuntu0.1fixed
Susegawklinux enterprise server ltss extended security 12 sp54.1.0-5.6.1fixed
Ubuntugawkpro1:4.2.1+dfsg-1.1build1vulnerable
Ubuntugawkpro1:5.0.1+dfsg-1vulnerable
Ubuntugawkpro1:5.0.1+dfsg-1ubuntu0.1vulnerable
Ubuntugawkpro1:5.0.1+dfsg-1ubuntu0.1+esm1fixed
Ubuntugawk22.041:5.1.0-1build1vulnerable
Ubuntugawk22.041:5.1.0-1build2vulnerable
Ubuntugawk22.041:5.1.0-1build3vulnerable
Ubuntugawk22.041:5.1.0-1ubuntu0.1vulnerable
Ubuntugawk22.041:5.1.0-1ubuntu0.2fixed
Ubuntugawk24.041:5.2.1-2vulnerable
Ubuntugawk24.041:5.2.1-2build2vulnerable
Ubuntugawk24.041:5.2.1-2build3vulnerable
Ubuntugawk24.041:5.2.1-2ubuntu0.1fixed
Ubuntugawk26.041:5.3.2-1build1vulnerable
Ubuntugawk26.041:5.3.2-1ubuntu1vulnerable
Ubuntugawk26.041:5.3.2-1ubuntu1.1fixed
CpegawkNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangawksourcesid(unfixed)not yet assignedNot reported[1142071]
Debiangawksourceforky(unfixed)not yet assignedNot reported[1142071]
Debiangawksourcetrixie(unfixed)not yet assignedNot reported[1142071]
Debiangawksourcebookworm(unfixed)not yet assignedNot reported[1142071]
Ubuntugawkdebnoble1:5.2.1-2ubuntu0.1Not reportedNot reportedNot reported
Susegawkrpmlinux enterprise server ltss extended security 12 sp54.1.0-5.6.1Not reportedSUSE-SU-2026:3211-1Not reported
Ubuntugawkdebpro1:5.0.1+dfsg-1ubuntu0.1+esm1Not reportedUBUNTU-CVE-2026-40468Not reported
Ubuntugawkdeb22.041:5.1.0-1ubuntu0.2Not reportedUBUNTU-CVE-2026-40468Not reported
Ubuntugawkdeb24.041:5.2.1-2ubuntu0.1Not reportedUBUNTU-CVE-2026-40468Not reported
Ubuntugawkdeb26.041:5.3.2-1ubuntu1.1Not reportedUBUNTU-CVE-2026-40468Not reported

[Debian bug #1142071]

Notes

[trixie] gawk: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gawk]Affected
    Details (2)

    • 1:5.2.1-2 · amd64 · bookworm

      Affected

      nvd · gawk · debian · bookworm; nvd · gawk · debian · 12

    • 1:5.2.1-2 · arm64 · bookworm

      Affected

      nvd · gawk · debian · bookworm; nvd · gawk · debian · 12

[Debian 13 (Trixie)]

  • [gawk]Affected

    Source package: [gawk]

    Details (2)

    • 1:5.2.1-2+b1 · amd64 · trixie

      Affected

      nvd · gawk · debian · 13

    • 1:5.2.1-2+b2 · arm64 · trixie

      Affected

      nvd · gawk · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]