An integer overflow has been identified in the builtin.c source file of GNU gawk. The overflow can lead to uncontrolled memory consumption on the host operating system and may allow an attacker to overwrite gawk heap metadata and heap objects with attacker‑controlled data. This weakness corresponds to CWE‑190. The vulnerability does not directly provide arbitrary code execution but can destabilize the target system by exhausting memory or corrupting heap structures.

GNU gawk version 5.4.0 and all earlier releases are vulnerable. Systems that ship gawk 5.4.0 or older – such as many Linux distributions – and custom installations that have not been upgraded beyond that release are at risk.

The CVSS score of 2.1 classifies this issue as low severity, and an EPSS score of <1 % indicates a very low likelihood of exploitation. The CVE is not present in the CISA KEV catalog. Exploitation requires an attacker to provide crafted input to gawk, feeding the integer overflow to consume memory or overwrite heap structures. No privilege escalation or network‑accessible entry point is described; the attack vector is inferred to be local execution or process‑level interaction with untrusted data.