Hi, The following vulnerabilities were published for gawk. CVE-2026-40467[0]: | Use After Free vulnerability has been found in "io.c" program file | of gawk (do_getline_redir() routine). This issue may lead to a | crash. It affects gawk in versions 5.4.0 and below. CVE-2026-40468[1]: | Integer overflow vulnerability has been found in "builtin.c" program | file of gawk. This issue may lead to memory exhaustion on the | hosting operating system and could be used to overwrite gawk heap | metadata and objects with attacker-controlled bytes. It affects gawk | in versions 5.4.0 and below. CVE-2026-40469[2]: | Integer overflow vulnerability has been found in "builtin.c" program | file of gawk (do_sub() routine). This issue could be used to | overwrite gawk heap metadata and objects causing the program to | crash. It affects 32-bit builds of gawk in versions 5.4.0 and below. CVE-2026-40553[3]: | Buffer overflow vulnerability has been found in | "extension/readdir.c" program file of gawk (ftype() routine). This | issue could be used to crash the program and potentially to achieve | code execution, although the latter has not been confirmed to be | feasible. It affects gawk in versions 5.4.0 and below. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-40467 https://www.cve.org/CVERecord?id=CVE-2026-40467 [1] https://security-tracker.debian.org/tracker/CVE-2026-40468 https://www.cve.org/CVERecord?id=CVE-2026-40468 [2] https://security-tracker.debian.org/tracker/CVE-2026-40469 https://www.cve.org/CVERecord?id=CVE-2026-40469 [3] https://security-tracker.debian.org/tracker/CVE-2026-40553 https://www.cve.org/CVERecord?id=CVE-2026-40553 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
Hello Adrian, Salvatore, [...] I picked up the task of handling gawk for LTS Team. As the problem is unfixed in unstable/testing/stable/LTS/ELTS releases I'm offering my assistance to NMU and fix the issues in all releases. I'm attaching initial draft patches for backporting the relevant upstream commits against the unstable version. I've also prepared a draft bookworm (LTS) update and the backported patches are very similar there. The trixie version is the same as bookworm. I'm thus proposing we fix the issues in unstable/testing by backporting patches as that should give some partial confidence that they are correct for older releases, and postpone updating to then new upstream release that is available. (Once unstable/testing is done, I'm willing to take care of stable-proposed-update next.) I'm also tempted at taking care of some lintian warnings while at it, but maybe I should resist the urge. Please speak up if you'd like to proceed differently! Regards, Andreas Henriksson