CVE-2026-40553
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A buffer overflow vulnerability has been found in the "extension/readdir.c" file of gawk in the ftype() routine. This issue could crash the program and potentially allow code execution, although the latter has not been confirmed. It affects gawk versions 5.4.0 and below.
Risk Assessment
An attacker could exploit this vulnerability to crash gawk, disrupting scripts and applications that rely on it. If code execution is confirmed, the risk includes potential system compromise.
Recommendation
Immediately upgrade gawk to a version newer than 5.4.0 once a patch is released. Until then, limit gawk usage in production environments and avoid processing untrusted data.
Other vulnerabilities in gawk
See all- CVE-2026-40469Critical
An integer overflow vulnerability has been found in the do_sub() routine in the "builtin.c" file of gawk. It affects 32-bit builds of gawk versions 5.4.0 and below, potentially allowing heap metadata overwrite and program crash.
- CVE-2026-40468Critical
An integer overflow vulnerability has been found in the "builtin.c" file of gawk versions 5.4.0 and below. This issue may lead to memory exhaustion on the hosting operating system and could allow an attacker to overwrite gawk heap metadata and objects with controlled bytes.
- CVE-2026-40467High
A Use After Free vulnerability has been found in the io.c file of gawk in the do_getline_redir() routine. It affects gawk versions 5.4.0 and below and may lead to a crash.
Original NVD description (English source)
Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.