Read the docs
TI-2026-40752 Aliases CVE-2026-56392GHSA-g24f-m2hx-pfgx

Heap-based Buffer Overflow in GNU coreutils

Priority LOW 9CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write. When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout. This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Partial Red Hat: 13 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUcoreutilsup to 9.11—No fix listedCNA
  • coreutils VendorGNU Affected up to 9.11 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*9.11VulnerableGNU
  • cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:* Versions 9.11 Vulnerable ·GNU

Remediation

Red Hat 13 advisories

  • RHSA-2026:81201 Released 2026-10-12 · Red Hat rating Important
    Cost Management Metrics Operator Update
    • Cost Management 4 registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator
  • RHSA-2026:79357 Released 2026-10-08 · Red Hat rating Important
    Red Hat Cost Management On-Premise container image update
    • Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
  • RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 10 more Red Hat advisories
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:71603 Released 2026-09-24 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:67886 Released 2026-09-16 · Red Hat rating Moderate
    coreutils security update
    • Red Hat Enterprise Linux BaseOS (v. 10) coreutils-9.5-8.el10_2.1, coreutils-single-9.5-8.el10_2.1
  • RHSA-2026:67956 Released 2026-09-16 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:66403 Released 2026-09-10 · Red Hat rating Moderate
    coreutils security update
    • Red Hat Enterprise Linux BaseOS (v. 9) coreutils-8.32-41.el9_8.1, coreutils-single-8.32-41.el9_8.1
  • RHSA-2026:40724 Released 2026-07-16 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images coreutils-9.11-5.hum1@aarch64, coreutils-9.11-5.hum1@src, coreutils-9.11-5.hum1@x86_64 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476
Cost Management 4Fixed RHSA-2026:81201
Red Hat Cost Management On-Premise 1Fixed RHSA-2026:79357
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:67886
Red Hat Enterprise Linux BaseOS (v. 8)Fixed—
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:66403
Red Hat Hardened ImagesFixed RHSA-2026:40724
Red Hat Update Infrastructure 5Fixed RHSA-2026:67956, RHSA-2026:71603
Not affected: 6 products
  • Cert Manager support for Red Hat OpenShift release 1.20
  • Cost Management 4
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56392
  2. 2026-10-03 Alias added: GHSA-g24f-m2hx-pfgx
  3. 2026-10-09 Fix available: RHSA-2026:79357 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
  5. 2026-10-13 Fix available: RHSA-2026:81201 · Red Hat
  6. 2026-10-13 Fix available: Cost Management 4 · Red Hat
  7. 2026-11-06 Affected versions changed · Red Hat
  8. 2026-11-06 Affected versions changed · Red Hat

References

Patch 1

Advisory 1

Other 1

  • TI-2017-13227 In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent… CVSS 3.1HIGH 7.1
  • TI-2015-01675 fts.c in coreutils 8.4 allows local users to delete arbitrary files. CVSS 3.1MEDIUM 5.1
  • TI-2015-03409 Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through… CVSS 3.1CRITICAL 9.8
  • TI-2014-07697 The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of… CVSS 2.0HIGH 7.5
  • TI-2015-03408 The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit… CVSS 3.1HIGH 7.8
  • TI-2024-00631 Coreutils: heap overflow in split --line-bytes with very long lines CVSS 3.1MEDIUM 5.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences