CVE-2026-40553: Fossies Gawk Buffer Overflow Vulnerability

CVE-2026-40553 Overview

CVE-2026-40553 is a stack-based buffer overflow [CWE-121] in the ftype() routine of the extension/readdir.c file in GNU gawk. The flaw affects gawk versions 5.4.0 and below. An attacker with local access can trigger the overflow to crash the program, and code execution is theoretically possible but has not been confirmed by the vendor. The issue was reported through CERT Poland and patched upstream in the GNU savannah gawk repository.

Critical Impact
Local attackers can crash gawk processes that use the readdir extension and may potentially achieve arbitrary code execution in the context of the invoking user.

Affected Products

GNU gawk versions 5.4.0 and earlier
Any application or script invoking the readdir extension via @load "readdir"
Linux and Unix distributions packaging vulnerable gawk builds

Discovery Timeline

2026-07-13 - CVE-2026-40553 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-40553

Vulnerability Analysis

The readdir extension in gawk provides directory iteration by exposing directory entries to AWK scripts. Inside extension/readdir.c, the ftype() helper resolves the file type of each returned entry. The routine writes into a fixed-size stack buffer without adequately validating the length of the input path components it constructs. When the resulting path exceeds the destination buffer, adjacent stack memory is overwritten.

The overflow corrupts stack frames, which reliably crashes gawk. Because the overwrite occurs on the stack, an attacker who controls the directory contents or path length may be able to influence return addresses or saved registers. The advisory notes that reliable code execution has not been demonstrated, but the class of bug is consistent with historical stack corruption exploits.

Root Cause

The root cause is missing bounds enforcement in ftype() when composing directory entry paths. The function assumes path components fit within a statically sized buffer, which does not hold when long directory names or deeply nested paths are processed. This maps directly to [CWE-121]: Stack-based Buffer Overflow.

Attack Vector

Exploitation requires local access. An attacker crafts a directory structure containing entries whose names, combined with the parent path, exceed the internal buffer size. When a user or automated job runs an AWK script that loads the readdir extension and iterates over the attacker-controlled directory, ftype() triggers the overflow. The vulnerability cannot be reached remotely without a separate vector that permits local script execution or directory placement.

No public exploit code is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the CERT Poland CVE Advisory for additional context.

Detection Methods for CVE-2026-40553

Indicators of Compromise

Unexpected gawk process crashes with SIGSEGV or SIGABRT recorded in system logs or coredumpctl.
Core dumps referencing ftype or readdir.c frames in the stack trace.
Directories containing entries with unusually long names created by unprivileged users.

Detection Strategies

Inventory installed gawk packages and flag hosts running versions at or below 5.4.0.
Audit AWK scripts and cron jobs for @load "readdir" usage to identify exposed workflows.
Enable core dump collection and review crashes involving the readdir extension shared object.

Monitoring Recommendations

Alert on repeated gawk termination events on shared hosts, batch systems, or CI runners.
Monitor filesystem creation of entries with maximum-length names in world-writable directories such as /tmp and /var/tmp.
Correlate gawk crashes with the invoking user and script path to identify tampered directories.

How to Mitigate CVE-2026-40553

Immediate Actions Required

Upgrade gawk to a version that includes commit cca0366144336b49aaa7d5d949966ce8e2c70843 from the upstream GNU repository.
Rebuild and redistribute any container images or golden images that ship gawk 5.4.0 or earlier.
Restrict execution of AWK scripts that traverse untrusted directories with the readdir extension.

Patch Information

The upstream fix is available in the GNU savannah gawk repository as commit cca0366144336b49aaa7d5d949966ce8e2c70843. Refer to the GNU Commit Update for the patch diff. Distribution maintainers should backport this commit to packaged versions of gawk 5.4.0 and earlier.

Workarounds

Avoid loading the readdir extension in scripts that process attacker-controlled directories.
Set restrictive permissions on directories iterated by privileged AWK jobs to prevent untrusted users from adding long-named entries.
Constrain gawk execution using standard OS controls such as ulimit, AppArmor, or SELinux profiles to limit blast radius.

bash

# Verify installed gawk version and identify vulnerable hosts
gawk --version | head -n 1

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade gawk

# RHEL / Fedora
sudo dnf upgrade gawk

# Confirm the patched build no longer reports 5.4.0 or earlier
gawk --version | head -n 1