Out-of-Bounds Read in GNU coreutils Uniq Affects Multiple Versions
CVE-2026-56391

4.6MEDIUM

Key Information:

Vendor

Gnu
Status
Coreutils
Vendor
CVE Published:
24 July 2026

What is CVE-2026-56391?

GNU coreutils' uniq command is impacted by an out-of-bounds read vulnerability due to improper handling of multibyte input with the -w (--check-chars) option. The find_field() function incorrectly calculates character byte lengths, leading to a misrepresentation of the buffer size. This results in potential crashes and exposure of adjacent heap memory when processing specially crafted input. The issue has been addressed in recent updates to the GNU coreutils package.

Affected Version(s)

coreutils 9.5 <= 9.11

References

https://cert.pl/en/posts/2026/07/CVE-2026-56391
third-party-advisory
https://git.savannah.gnu.org/cgit/coreutils.git/
product
https://git.savannah.gnu.org/cgit/coreutils.git/commit/?i...
patch

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.