CVE-2026-40553

A flaw was found in gawk. A buffer overflow vulnerability exists in the ftype() routine, located in the extension/readdir.c program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, though this has not been definitively confirmed.

Moderate: A buffer overflow in gawk's ftype() routine, when processing untrusted input, could lead to a denial of service or potentially arbitrary code execution. This is rated Moderate as successful exploitation requires user interaction, such as processing a specially crafted file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run gawk against untrusted scripts, files, or directories to prevent triggering these vulnerabilities. If an attack is attempted, Red Hat's built-in memory protections will safely crash the program, preventing malicious code execution.