This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-40468 →

DEBIAN-CVE-2026-40468

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating s...

Original description

The description as published by the source.

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 gawk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 gawk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 gawk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org