CVE-2026-40468CWE-190

Heap buffer overflow in gawk

Low · published July 13, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-07-13T12:07Z
EPSS history
Timeline
  • 13 JUL 12:07Z
    Heap buffer overflow in gawk
    cvelistv5