Report an incident
Back
  • About us
  • For experts
Report an incident
About us
About our team Contact
Baza wiedzy
Fałszywe inwestycje Uważaj na fałszywe sklepy online (Nie)bezpieczne płatności Fałszywi konsultanci Zadbaj o bezpieczne hasła i logowanie Fałszywe załączniki w mailach Fałszywe prośby o szybki przelew Bezpieczny telefon
Biuletyn OUCH!
Porady bezpieczeństwa OUCH!
Tools
n6 Artemis MWDB
CVD program
CVD policy Advisories

Vulnerabilities in GNU coreutils software
24 July 2026 | CERT Polska | #vulnerability, #warning, #cve
CVE ID CVE-2026-56391
Publication date 24 July 2026
Vendor GNU
Product coreutils
Vulnerable versions From 9.5 through 9.11
Vulnerability type (CWE) Out-of-bounds Read (CWE-125)
Report source Report to CERT Polska
CVE ID CVE-2026-56392
Publication date 24 July 2026
Vendor GNU
Product coreutils
Vulnerable versions All through 9.11
Vulnerability type (CWE) Heap-based Buffer Overflow (CWE-122)
Report source Report to CERT Polska

Description

CERT Polska has received a report about vulnerabilities in GNU coreutils software and participated in coordination of their disclosure.

The vulnerability CVE-2026-56391: GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.

When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.

This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

The vulnerability CVE-2026-56392: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.

When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.

This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

Credits

We thank Michał Majchrowicz and Marcin Wyczechowski from AFINE Team for the responsible vulnerability report.

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.