CVE-2026-56392: GNU Coreutils Buffer Overflow Vulnerability

CVE-2026-56392 Overview

CVE-2026-56392 is a heap-based buffer overflow in GNU coreutils unexpand caused by an integer overflow during buffer allocation. When unexpand processes large tab stop values supplied via the -t argument, the multiplication used to compute the allocation size wraps around and returns an undersized buffer. Subsequent writes exceed the allocated region, producing an out-of-bounds heap write [CWE-122].

The issue requires local access and user interaction to run unexpand with attacker-controlled arguments. Exploitation results in a crash and can yield a heap write primitive depending on the memory layout at runtime. Maintainers fixed the flaw in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d.

Critical Impact
Attackers with local access can trigger an out-of-bounds heap write in unexpand, causing crashes and potentially enabling memory corruption primitives in scripts or pipelines that pass untrusted -t values.

Affected Products

GNU coreutils unexpand utility (versions prior to the fix commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d)
Linux and Unix-like distributions bundling vulnerable coreutils builds
Automation, build, and data-processing pipelines invoking unexpand -t with untrusted input

Discovery Timeline

2026-07-24 - CVE-2026-56392 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-56392

Vulnerability Analysis

The vulnerability resides in the buffer allocation logic of the unexpand utility within GNU coreutils. unexpand converts sequences of spaces to tabs and accepts a list of tab stop positions through the -t command-line option. When calculating how much memory to allocate for its internal tab stop table, the code multiplies a count by an element size without validating the operands.

With sufficiently large -t values, this multiplication overflows the fixed-width integer used to hold the result. The allocator receives a small size value and returns a buffer far smaller than the caller expects. Subsequent loops that populate the tab stop data write past the end of the undersized heap chunk, corrupting adjacent heap metadata or neighboring allocations.

Root Cause

The root cause is a missing overflow check in the size calculation preceding the heap allocation. The multiplication of the tab stop count by the per-element size can wrap around the integer range, producing a small allocation request for a large logical buffer. The subsequent write loop uses the original, un-wrapped count as its bound, guaranteeing an out-of-bounds heap write when the crafted -t value is processed.

Attack Vector

Exploitation requires an attacker to influence the arguments passed to unexpand, specifically the value supplied to -t. This typically arises in shell scripts, build systems, or web-adjacent services that invoke unexpand with parameters derived from user-controlled input. A local attacker who can execute the command directly, or one who can control an argument fed into an unexpanded pipeline, triggers the integer overflow and forces the out-of-bounds heap write. The immediate observable effect is a crash of the unexpand process, with the potential for further memory corruption depending on heap layout.

No verified public exploit code is available. Refer to the GNU Coreutils commit detail and the CERT security advisory for source-level analysis.

Detection Methods for CVE-2026-56392

Indicators of Compromise

Unexpected crashes or SIGABRT signals from the unexpand process, especially with glibc heap corruption messages such as malloc(): corrupted top size or free(): invalid pointer.
Core dumps referencing unexpand with abnormally large numeric arguments to -t.
Shell history or audit logs showing invocations of unexpand -t with values approaching or exceeding platform integer limits.

Detection Strategies

Monitor process execution telemetry for unexpand invocations that include suspiciously large integer values or comma-separated lists passed to the -t flag.
Correlate abnormal exits of coreutils binaries with the arguments that produced them to surface exploitation attempts against related integer-overflow bugs.
Track execve events from auditd or equivalent kernel-level logging and alert on unexpand executions originating from network-facing services or unprivileged users.

Monitoring Recommendations

Enable auditd rules covering execution of /usr/bin/unexpand and other coreutils binaries with argument capture.
Forward host command-line telemetry into a centralized data lake for retroactive hunting on -t argument patterns.
Ingest crash dumps and glibc abort messages into log pipelines to detect memory-corruption side effects at scale.

How to Mitigate CVE-2026-56392

Immediate Actions Required

Update GNU coreutils to a build that includes commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d or later once distribution packages ship the fix.
Audit shell scripts, cron jobs, and services that invoke unexpand with externally influenced arguments and add input validation for the -t value.
Restrict execution of unexpand on multi-tenant or shared systems where local users could pass crafted arguments through downstream tooling.

Patch Information

The upstream fix is available in the GNU coreutils repository as commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. Track your Linux distribution's coreutils package advisories and upgrade once patched builds are published. See the GNU Coreutils repository and the commit detail for the source change.

Workarounds

Validate and cap any user-controlled numeric input before passing it to unexpand -t, rejecting values that exceed a sane maximum such as the terminal width or a small fixed ceiling.
Avoid invoking unexpand on untrusted argument input; substitute equivalent processing in a memory-safe language where feasible.
Constrain the utility using AppArmor, SELinux, or seccomp profiles that limit its execution context and reduce the impact of a crash or heap corruption event.

bash

# Configuration example: reject oversized -t arguments before invoking unexpand
safe_unexpand() {
  local tabstop="$1"
  shift
  if ! [[ "$tabstop" =~ ^[0-9]+$ ]] || (( tabstop > 256 )); then
    echo "Invalid tab stop value" >&2
    return 1
  fi
  unexpand -t "$tabstop" "$@"
}