Buffer overflow in GNU Coreutils
CVE-2026-56392
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write. When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout. This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H.
EPSS exploit prediction
EPSS: 0.002 (7.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 7.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- GNU Coreutils — versions 9.11, 0
Weakness classification (CWE)
References
- cert.pl/en/posts/2026/07/CVE-2026-56391 (Third Party Advisory, third-party-advisory)
- git.savannah.gnu.org/cgit/coreutils.git/ (Product, product)
- git.savannah.gnu.org/cgit/coreutils.git/commit/ (Patch, patch)
Frequently asked questions
- What is CVE-2026-56392?
- CVE-2026-56392 is a medium-severity vulnerability in GNU Coreutils, classified under Heap-based Buffer Overflow. CVSS score: 6.1/10. Published 2026-07-24.
- How severe is CVE-2026-56392?
- Medium severity. CVSS v3 base score is 6.1 out of 10.