Description
Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.
Published: 2026-07-13
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A Use-After-Free flaw was identified in the do_getline_redir() routine of gawk’s io.c file. The vulnerability can cause the program to terminate unexpectedly, resulting in a denial-of-service condition. This weakness is classified as CWE-416.

Affected Systems

GNU gawk versions 5.4.0 and earlier are affected. No specific fixed release is listed in the CVE data; users must seek an updated release or apply the official patch.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score of < 1% reflects a very low but non-zero likelihood, and it is not listed in CISA’s KEV catalog. It can be triggered by feeding specially crafted input to gawk; the attack vector is inferred to be local or remote through processed data, but it does not provide remote code execution.

Generated by OpenCVE AI on July 31, 2026 at 11:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the source patch available from the GNU gawk repository for commit a2d18c74109e41bec29a23098eba2e00057286d8.
  • If a patched binary is released in a newer gawk version, upgrade to that release.
  • If patching or upgrading cannot be performed, restrict execution of gawk scripts to trusted inputs, monitor for crashes, and consider running gawk within a watchdog or container to isolate any impact.

Generated by OpenCVE AI on July 31, 2026 at 11:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8588-1 Gawk vulnerabilities
History

Mon, 13 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu gawk
Vendors & Products Gnu
Gnu gawk

Mon, 13 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Description Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.
Title Use after free in gawk
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Gnu Gawk
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-13T13:02:22.646Z

Reserved: 2026-04-13T14:44:55.647Z

Link: CVE-2026-40467

cve-icon Vulnrichment

Updated: 2026-07-13T13:02:18.720Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:45:13Z

Weaknesses