CVE-2026-40469: Fossies Gawk DOS Vulnerability

CVE-2026-40469 Overview

CVE-2026-40469 is an integer overflow vulnerability [CWE-190] in the do_sub() routine within the builtin.c source file of GNU gawk. The flaw affects 32-bit builds of gawk in versions 5.4.0 and below. When triggered, the overflow can corrupt heap metadata and objects, causing the program to crash. The issue is a local, low-complexity vulnerability that requires no privileges or user interaction. The impact is limited to availability, with no direct impact on confidentiality or integrity. The vulnerability was disclosed through a CERT Poland advisory and addressed in the upstream GNU gawk Git repository.

Critical Impact
Local attackers can craft input that triggers heap corruption inside gawk, causing the interpreter to crash and disrupting automated processing pipelines and scripts.

Affected Products

GNU gawk versions 5.4.0 and below (32-bit builds)
Fossies gawk distributions containing the vulnerable builtin.c
Downstream Linux and UNIX packages shipping unpatched 32-bit gawk

Discovery Timeline

2026-07-13 - CVE-2026-40469 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-40469

Vulnerability Analysis

The vulnerability resides in the do_sub() routine of builtin.c, which implements the sub() and gsub() substitution functions in gawk. During substitution processing, gawk calculates buffer sizes to hold the resulting string after pattern replacement. On 32-bit builds, these size calculations can overflow the fixed-width integer used for length tracking. The overflow produces a smaller allocation than required for the actual output. Subsequent writes then exceed the allocated heap region and overwrite adjacent heap metadata and objects. The corruption typically manifests as an allocator abort or segmentation fault when gawk next interacts with the affected heap chunks.

Root Cause

The root cause is unchecked arithmetic on length values that exceed the INT_MAX boundary on 32-bit platforms. When an AWK program invokes sub() or gsub() with input and replacement patterns that expand the working string beyond 32-bit integer limits, the size computation wraps. gawk then allocates a heap buffer sized to the wrapped value while continuing to write the full expanded output. This mismatch produces a classic integer-overflow-to-heap-overflow chain characteristic of [CWE-190].

Attack Vector

Exploitation requires local execution of a crafted AWK script or the processing of attacker-influenced input through an AWK program that performs substitution on untrusted data. A common exposure pattern is a log-processing or data-transformation pipeline that pipes external content into gawk scripts using sub() or gsub(). The attacker supplies input engineered to expand beyond the 32-bit length boundary during substitution. 64-bit builds are not affected because the size arithmetic does not overflow within the wider integer range. The observed impact is program crash; arbitrary code execution has not been demonstrated in the referenced advisories.

Detailed technical analysis is available in the CERT Poland Advisory CVE-2026-40467 and the upstream fix is documented in the GNU Gawk Commit Log Entry.

Detection Methods for CVE-2026-40469

Indicators of Compromise

Unexpected crashes or SIGABRT from gawk processes on 32-bit hosts, especially in log-processing or ETL pipelines.
glibc heap corruption messages such as malloc(): corrupted top size or double free or corruption associated with gawk execution.
Core dumps from gawk whose stack traces reference do_sub, sub_common, or related routines in builtin.c.

Detection Strategies

Inventory installed gawk packages across the fleet and identify any 32-bit builds at version 5.4.0 or earlier.
Review AWK scripts that call sub() or gsub() on externally sourced strings and flag those exposed to attacker-controlled input.
Monitor process telemetry for repeated abnormal terminations of awk or gawk binaries, which may indicate exploitation attempts.

Monitoring Recommendations

Centralize collection of crash dumps and syslog entries containing gawk errors for correlation across hosts.
Alert on new invocations of gawk that consume unusually large input streams to substitution functions.
Track patch state of gawk through package management telemetry and continuous vulnerability scanning.

How to Mitigate CVE-2026-40469

Immediate Actions Required

Update gawk to a patched release that includes upstream commit ae1b2d508f46913269a9e62aceda3636afe8147b on all 32-bit systems.
Where feasible, migrate 32-bit hosts running gawk to 64-bit builds, which are not affected by this overflow.
Audit AWK scripts that process untrusted input through sub() and gsub() and restrict exposure to attacker-controlled data.

Patch Information

The upstream fix is available in the GNU gawk source repository at commit ae1b2d508f46913269a9e62aceda3636afe8147b. Distribution maintainers are expected to backport the patch into supported gawk packages. Refer to the GNU Gawk Commit Log Entry for the exact change to builtin.c.

Workarounds

Enforce input size limits on data passed to gawk substitution routines through wrapper scripts or preprocessing steps.
Restrict local execution of gawk on 32-bit hosts to trusted users and validated scripts until the patch is applied.
Replace vulnerable substitution logic with equivalent processing in a 64-bit interpreter or another tool such as sed where practical.

bash

# Configuration example: verify installed gawk version and architecture
gawk --version | head -n 1
file $(command -v gawk)

# Debian/Ubuntu: upgrade gawk to the patched package
sudo apt-get update && sudo apt-get install --only-upgrade gawk

# RHEL/Fedora: upgrade gawk to the patched package
sudo dnf upgrade gawk