CVE-2026-40469 is an integer overflow in the do_sub routine of GNU gawk, scored CVSS 9.1. It affects 32 bit builds of gawk version 5.4.0 and below and can corrupt heap data and crash the program. Update through your distribution. Check whether your build is 32 bit.
What's affected
From the record and the CERT Polska notice:
- Affected: 32 bit builds of gawk, versions 5.4.0 and below
- Fix reference: a commit in the gawk repository
The CERT notice lists the vulnerable versions as all through 5.4.0. The record narrows this CVE to 32 bit builds. No fixed release number appears in the sources I read, so check your distribution.
How to check if you're exposed
Check version and architecture:
gawk --version
uname -m
file $(which gawk)
A 64 bit build, shown as x86_64 or aarch64, falls outside the 32 bit condition in the record. Many embedded systems and older images still use 32 bit userlands, so check those, along with containers built for 32 bit targets.
What to do now
- Identify 32 bit systems and images that include gawk.
- Install the distribution update when available.
- Rebuild images from updated bases.
- Avoid processing untrusted input with gawk on those systems until patched.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. On a 32 bit build, a size value reaches its limit sooner, and a wrapped value leads to a buffer smaller than the data written into it. The record says this can overwrite heap metadata and objects and crash the program.
The practical exposure is narrower than the score implies because it needs a 32 bit build and a way to feed crafted input. It is still worth patching on embedded and legacy systems. The record does not flag exploitation in the wild.
Quick check
Am I safe on a 64 bit system?
The record limits this CVE to 32 bit builds. Other gawk CVEs in the same notice may still apply, so update anyway.
Sources
Last reviewed: 19 October 2026.
