{"id":"CVE-2026-40469","summary":"Heap buffer overflow in gawk","details":"Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.","modified":"2026-10-21T10:45:57.562964090Z","published":"2026-07-13T12:07:55.692Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40469.json","unresolved_ranges":[{"extracted_events":[{"range":[{"last_affected":"5.4.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"last_affected":"5.4.0"}]}]}],"cna_assigner":"CERT-PL","cwe_ids":["CWE-190"]},"references":[{"type":"WEB","url":"https://cgit.git.savannah.gnu.org/cgit/gawk.git/"},{"type":"ADVISORY","url":"https://cert.pl/en/posts/2026/07/CVE-2026-40467"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40469.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40469"},{"type":"FIX","url":"https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://cgit.git.savannah.gnu.org/cgit/gawk.git","events":[{"introduced":"0"},{"fixed":"ae1b2d508f46913269a9e62aceda3636afe8147b"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"ae1b2d508f46913269a9e62aceda3636afe8147b"}],"source":"REFERENCES_COMMIT"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40469.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}