CVE-2026-40468 is an integer overflow in GNU gawk, scored CVSS 9.1. In builtin.c it can lead to memory exhaustion and to overwriting heap data. Versions through 5.4.0 are affected. No fixed release is named in the sources, so apply your distribution update.
What's affected
From the CERT Polska notice published 13 July 2026 and the record:
- Affected: gawk, all versions through 5.4.0
- Fix reference: a commit in the gawk repository on savannah.gnu.org
The notice covers four gawk CVEs reported together. This guide is about CVE-2026-40468, the integer overflow in builtin.c. I did not find a fixed release number in the sources I read, so I will not state one. Check the gawk project or your distribution for it.
How to check if you're exposed
Check the installed version:
gawk --version
If it reports 5.4.0 or earlier, look at your distribution's security tracker for this CVE. Distributions typically backport fixes, so the tracker tells you which package version contains it. Also look for gawk in container images and in build tooling.
What to do now
- Update gawk through your package manager once your distribution ships the fix.
- Rebuild container images from updated bases.
- Avoid running gawk scripts from untrusted sources against untrusted input until updated.
- Look at where gawk runs in automation that handles outside data.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. When a size calculation wraps, a program may allocate less memory than it later writes, which damages nearby data. The record says this one could lead to memory exhaustion and to overwriting heap metadata with attacker controlled bytes.
gawk is a command line tool, so exposure depends on how you use it. A service that feeds untrusted text into gawk makes this much more relevant than a developer using it on local files. The record does not flag exploitation in the wild.
Quick check
Is this the same as CVE-2026-40469?
No. That is a separate overflow in the do_sub routine, affecting 32 bit builds. Both were published in the same CERT Polska notice.
Sources
Last reviewed: 19 October 2026.
