{"id":"CVE-2026-56391","summary":"Out‑of‑bounds Read in GNU coreutils","details":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.","modified":"2026-09-03T11:47:35.546761625Z","published":"2026-07-24T07:44:45.581Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56391.json","cna_assigner":"CERT-PL"},"references":[{"type":"WEB","url":"https://git.savannah.gnu.org/cgit/coreutils.git/"},{"type":"ADVISORY","url":"https://cert.pl/en/posts/2026/07/CVE-2026-56391"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56391.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391"},{"type":"FIX","url":"https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://cgit.git.savannah.gnu.org/cgit/coreutils.git","events":[{"introduced":"0"},{"fixed":"d64e35a8a4c0e4608321433e0d84d917e4e36371"}],"database_specific":{"source":"REFERENCES"}},{"type":"GIT","repo":"https://github.com/coreutils/coreutils","events":[{"introduced":"cc8689a07c8cfece66707936e3b914174912bd36"},{"last_affected":"c01fd163a47468a8296fb369f5233853bb551bb6"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.5"},{"last_affected":"9.11"}]}},{"type":"GIT","repo":"https://https.git.savannah.gnu.org/git/coreutils.git/","events":[{"introduced":"cc8689a07c8cfece66707936e3b914174912bd36"},{"last_affected":"c01fd163a47468a8296fb369f5233853bb551bb6"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"9.5"},{"last_affected":"9.11"}]}}],"versions":["v9.11","v9.10","v9.9","v9.8","v9.7","v9.6","v9.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56391.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"}]}