CVE-2026-40468
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An integer overflow vulnerability has been found in the "builtin.c" file of gawk versions 5.4.0 and below. This issue may lead to memory exhaustion on the hosting operating system and could allow an attacker to overwrite gawk heap metadata and objects with controlled bytes.
Risk Assessment
An attacker could exploit this vulnerability to cause a denial of service (DoS) or potentially gain control over the gawk process, threatening system integrity and availability.
Recommendation
It is recommended to immediately upgrade gawk to a version newer than 5.4.0, which includes a fix for the integer overflow.
Original NVD description (English source)
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.