GNU coreutils unexpand can overflow a heap buffer due to an integer overflow during allocation of the tab‑stop array. When attacker‑controlled large -t values are processed, the multiplication used to compute the buffer size can wrap around, leading to an undersized buffer. Subsequent writes exceed the allocated memory, causing an out‑of‑bounds write that may corrupt heap data, crash the program, or provide a write primitive. Based on the description, it is inferred that an attacker could supply crafted -t arguments to exploit this flaw, potentially risking denial of service or further compromise if execution privileges can be gained.

All releases of GNU coreutils that include the unexpand utility and were built before the commit identified by b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d are affected. No specific version range is listed, so any deployment of coreutils that has not been updated to a revision after that commit inherits this flaw.

The CVSS score of 1.8 indicates a low overall impact, and the EPSS score of less than 1% suggests that exploitation is unlikely and possibly limited to manually crafted local or remote input. The vulnerability is not present in the CISA KEV list, further reducing the urgency for widespread mitigation. However, the presence of a heap write primitive could be leveraged by an attacker with sufficient privileges or in a compromised foothold. The likely attack vector is an attacker providing crafted large tab stop arguments to the unexpand utility, which can trigger the overflow. Overall, the risk is low but not negligible for environments that use unexpand with user‑supplied or untrusted tab‑stop values.