CVE-2026-56391: GNU Coreutils Buffer Overflow Vulnerability

CVE-2026-56391 Overview

CVE-2026-56391 is an out-of-bounds read vulnerability in GNU coreutils uniq triggered by malformed multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters because it repeatedly processes a fixed pointer instead of advancing through the input buffer. The inflated length is subsequently passed to memcmp, which reads beyond the allocated heap buffer. Attackers who control the arguments passed to uniq can crash the process and potentially expose adjacent heap memory. The issue is tracked under CWE-125 and has been fixed upstream in commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Critical Impact
Crafted multibyte input processed by uniq -w can crash the utility and leak adjacent heap memory contents to a local attacker.

Affected Products

GNU coreutils uniq utility (versions prior to fix commit d64e35a8a4c0e4608321433e0d84d917e4e36371)
Linux and Unix-like distributions bundling vulnerable coreutils builds
Automation pipelines and scripts that invoke uniq -w on untrusted text input

Discovery Timeline

2026-07-24 - CVE-2026-56391 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-56391

Vulnerability Analysis

The defect resides in the find_field() routine of uniq. When -w N limits comparisons to the first N characters, uniq must translate a character count into a byte length for multibyte encodings such as UTF-8. Instead of advancing the pointer after decoding each character, the loop re-reads from the same starting position. The resulting byte length grows past the actual size of the decoded region.

Downstream, uniq uses this inflated length in a memcmp call to compare adjacent lines. memcmp therefore reads bytes that lie outside the allocated line buffer. Depending on heap layout, this either segfaults the process or returns comparison results influenced by uninitialized or unrelated heap memory, which can be observed through program behavior or output timing.

The EPSS score is 0.135%, reflecting a low probability of opportunistic exploitation. However, uniq is frequently invoked inside shell pipelines that process user-controlled data, which broadens the practical attack surface on multi-user systems.

Root Cause

The root cause is incorrect pointer arithmetic during multibyte character length calculation in find_field(). The function fails to advance through the input, producing a byte length larger than the buffer it describes. This violates the safe-length invariant required by the subsequent memcmp comparison [CWE-125].

Attack Vector

Exploitation requires local access with the ability to supply attacker-controlled arguments or input to a uniq -w invocation. A common scenario is a privileged script or service that pipes untrusted text through uniq -w N and exposes stdout, exit status, or timing to a lower-privileged user. The attacker crafts multibyte sequences that maximize the length miscalculation and observes crashes or side-channel signals from the out-of-bounds read.

No verified public exploit code is available. Refer to the CERT Security Advisory for CVE-2026-56391 and the upstream GNU Coreutils commit d64e35a for technical details.

Detection Methods for CVE-2026-56391

Indicators of Compromise

Repeated SIGSEGV or SIGABRT crashes originating from the uniq binary in system logs, dmesg, or journalctl output.
Core dumps for uniq referencing find_field() or memcmp in their stack traces.
Unexpected invocations of uniq -w or uniq --check-chars against files sourced from untrusted upload directories or user home paths.

Detection Strategies

Inventory installed coreutils packages across Linux hosts and compare versions against distribution advisories referencing commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Audit shell scripts, cron jobs, and CI pipelines for uniq -w usage on inputs that cross a trust boundary.
Enable AddressSanitizer or run uniq under valgrind in test environments to surface heap out-of-bounds reads on suspicious inputs.

Monitoring Recommendations

Alert on abnormal termination of coreutils processes with segmentation faults, particularly uniq.
Monitor process execution telemetry for uniq invocations with the -w or --check-chars flag and correlate against the input source.
Track package management events (apt, dnf, zypper) to confirm patched coreutils versions are installed fleet-wide.

How to Mitigate CVE-2026-56391

Immediate Actions Required

Update GNU coreutils to a distribution build that incorporates upstream commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Audit and remove unnecessary use of uniq -w on untrusted or attacker-influenced input.
Restrict local shell access on multi-user systems where uniq -w is invoked by privileged workflows.

Patch Information

The fix corrects pointer advancement in find_field() so the multibyte byte length reflects the actual number of bytes consumed. Apply the upstream patch from the GNU Coreutils repository or install the vendor-supplied coreutils package that references commit d64e35a8a4c0e4608321433e0d84d917e4e36371. Review the CERT Security Advisory for CVE-2026-56391 for distribution-specific guidance.

Workarounds

Avoid the -w / --check-chars option when processing multibyte input; rely on default whole-line comparison instead.
Force a single-byte locale such as LC_ALL=C for pipelines that must use -w, which bypasses the multibyte code path.
Pre-sanitize inputs to strict ASCII before feeding them to uniq -w in privileged scripts.

bash

# Temporary mitigation: run uniq in the C locale to skip multibyte handling
LC_ALL=C uniq -w 16 input.txt > output.txt

# Verify patched coreutils version after upgrade
uniq --version