CVE-2026-40467
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A Use After Free vulnerability has been found in the io.c file of gawk in the do_getline_redir() routine. It affects gawk versions 5.4.0 and below and may lead to a crash.
Risk Assessment
The risk involves potential crashes or hangs of gawk during data processing, which can disrupt scripts and systems relying on this tool.
Recommendation
It is recommended to upgrade gawk to a version newer than 5.4.0 where this vulnerability is fixed. Also monitor official security advisories.
Other vulnerabilities in gawk
See all- CVE-2026-40469Critical
An integer overflow vulnerability has been found in the do_sub() routine in the "builtin.c" file of gawk. It affects 32-bit builds of gawk versions 5.4.0 and below, potentially allowing heap metadata overwrite and program crash.
- CVE-2026-40468Critical
An integer overflow vulnerability has been found in the "builtin.c" file of gawk versions 5.4.0 and below. This issue may lead to memory exhaustion on the hosting operating system and could allow an attacker to overwrite gawk heap metadata and objects with controlled bytes.
- CVE-2026-40553High
A buffer overflow vulnerability has been found in the "extension/readdir.c" file of gawk in the ftype() routine. This issue could crash the program and potentially allow code execution, although the latter has not been confirmed. It affects gawk versions 5.4.0 and below.
Original NVD description (English source)
Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.