Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-56391 and CVE-2026-56392) found in GNU coreutils software.
Analysis Summary
# Vulnerability: Multiple Flaws in GNU coreutils (uniq and unexpand)
## CVE Details
- **CVE ID**: CVE-2026-56391 / CVE-2026-56392
- **CVSS Score**: Not specifically rated in report (Estimated: High)
- **CWE**:
- CWE-125: Out-of-bounds Read (CVE-2026-56391)
- CWE-122: Heap-based Buffer Overflow (CVE-2026-56392)
## Affected Systems
- **Products**: GNU coreutils
- **Versions**:
- **CVE-2026-56391**: Versions 9.5 through 9.11
- **CVE-2026-56392**: All versions through 9.11
- **Configurations**:
- Use of `uniq` with `-w` (`--check-chars`) flag and multibyte input.
- Use of `unexpand` with `-t` (large tab stop) values.
## Vulnerability Description
GNU coreutils is a package of basic file, shell, and text manipulation utilities. Two distinct vulnerabilities were identified:
1. **CVE-2026-56391 (uniq):** The `find_field()` function incorrectly handles multibyte characters when the `--check-chars` option is invoked. The function fails to advance a pointer correctly, leading to an inflated character length calculation. This length is passed to `memcmp`, resulting in an out-of-bounds read. This can lead to a crash or exposure of adjacent heap memory.
2. **CVE-2026-56392 (unexpand):** This utility suffers from an integer overflow during buffer allocation. When a user provides a very large tab stop (`-t`) value, the multiplication used to calculate memory size wraps around, resulting in an undersized heap buffer. Subsequent input processing leads to a heap-based buffer overflow.
## Exploitation
- **Status**: Report prepared by AFINE Team; No current evidence of exploitation in the wild.
- **Complexity**: Medium (Requires specific application flags and crafted input).
- **Attack Vector**: Local (Attacker must be able to provide arguments or input to the affected binaries).
## Impact
- **Confidentiality**: Low/Moderate (Potential heap memory exposure via CVE-2026-56391).
- **Integrity**: Moderate/High (Possible heap write primitive via CVE-2026-56392).
- **Availability**: High (Both vulnerabilities can lead to application crashes/DoS).
## Remediation
### Patches
Users should update GNU coreutils to a version incorporating the following commits:
- **CVE-2026-56391 Fix**: Commit `d64e35a8a4c0e4608321433e0d84d917e4e36371`
- **CVE-2026-56392 Fix**: Commit `b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d`
### Workarounds
- Avoid using `uniq -w` with untrusted multibyte input.
- Restrict or sanitize the integer values passed to the `unexpand -t` command in automated scripts or web-to-shell interfaces.
## Detection
- Monitor for segmentation faults in `uniq` or `unexpand` processes.
- Security scanners can check the version of `coreutils` against the vulnerable range (up to 9.11).
## References
- CERT Polska Advisory: [https://cert.pl/en/posts/2026/07/vulnerabilities-in-gnu-coreutils/](https://cert.pl/en/posts/2026/07/vulnerabilities-in-gnu-coreutils/)
- CVE Record (Out-of-bounds Read): [https://www.cve.org/CVERecord?id=CVE-2026-56391](https://www.cve.org/CVERecord?id=CVE-2026-56391)
- CVE Record (Heap Overflow): [https://www.cve.org/CVERecord?id=CVE-2026-56392](https://www.cve.org/CVERecord?id=CVE-2026-56392)