CVE-2026-56391
published 2026-07-24CVE-2026-56391: GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The…
PriorityP423medium4.6CVSS 4.0
AVLACLATNPRNUIAVCLVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.14%
3.3th percentile
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value.
This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.
When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | coreutils | 9.5 – 9.11 | — |
| uutils | coreutils | — | — |
CVSS provenance
nvdv4.04.6MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
vendor_redhat·2026-07-24·CVSS 4.6
CVE-2026-56391 [MEDIUM] CWE-125 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
A flaw was found in GNU coreutils uniq. When processing specially crafted multibyte input with the --check-chars option, an attacker can trigger an out-of-bounds read. This vulnerability can lead to a denial of service (DoS) due to an application crash and potentially expose sensitive information from adjacent memory.
Statement: This Moderate flaw in GNU coreutils `uniq` allows an out-of-bounds read when processing specially crafted multibyte input with the `--check-chars` option. An attacker providing malicious input to `uniq` could trigger a denial of service due to an application crash, and potentially disclose adjacent heap memory. Exploitation requires local user i
GHSA
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used.
ghsa_unreviewed·2026-07-24
CVE-2026-56391 [MEDIUM] CWE-125 GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used.
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value.
This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.
When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56391 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input [fedora-all]
bugzilla·2026-07-27·CVSS 4.6
CVE-2026-56391 [MEDIUM] CVE-2026-56391 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input [fedora-all]
CVE-2026-56391 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value.
This incorrect length is later used in a memcmp operation, causing reads beyond the alloc
Bugzilla
CVE-2026-56391 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
bugzilla·2026-07-24·CVSS 4.6
CVE-2026-56391 [MEDIUM] CVE-2026-56391 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
CVE-2026-56391 coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value.
This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.
When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
This issue has been fixed in the commit
2026-07-24
Published