CVE-2026-40469
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An integer overflow vulnerability has been found in the do_sub() routine in the "builtin.c" file of gawk. It affects 32-bit builds of gawk versions 5.4.0 and below, potentially allowing heap metadata overwrite and program crash.
Risk Assessment
An attacker could exploit this vulnerability to crash gawk, disrupting scripts and applications that depend on it, potentially leading to denial of service.
Recommendation
Upgrade gawk to a version later than 5.4.0 or apply the security patch. Prioritize updating on 32-bit systems.
Original NVD description (English source)
Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.