Skip to content
Fencer Vulns
medium 6.1

CVE-2026-56392 json

Heap-based Buffer Overflow in GNU coreutils

published 2026-07-24 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-48525 , GHSA-g24f-m2hx-pfgx , JLSEC-2026-1196

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.

When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.

This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

Patch / fix

  • coreutils RHEL 10.2 9.5-8.el10_2.1
  • coreutils-single RHEL 10.2 9.5-8.el10_2.1
  • coreutils RHEL 9 8.32-41.el9_8.1
  • coreutils-single RHEL 9 8.32-41.el9_8.1
  • coreutils RHEL 8 8.30-20.el8_10
  • coreutils-common RHEL 8 8.30-20.el8_10
  • coreutils-single RHEL 8 8.30-20.el8_10
  • coreutils hummingbird 1 9.11-5.hum1

red hat advisories RHSA-2026:67886RHSA-2026:66403RHBA-2026:47115RHSA-2026:40724

  • coreutils openSUSE Tumbleweed 9.11-5.1

opensuse advisories openSUSE-SU-2026:11764-1

  • coreutils AlmaLinux 10 9.5-8.el10_2.1
  • coreutils-common AlmaLinux 10 9.5-8.el10_2.1
  • coreutils-single AlmaLinux 10 9.5-8.el10_2.1
  • coreutils AlmaLinux 9 8.32-41.el9_8.1
  • coreutils-common AlmaLinux 9 8.32-41.el9_8.1
  • coreutils-single AlmaLinux 9 8.32-41.el9_8.1

almalinux advisories ALSA-2026:67886ALSA-2026:66403

  • coreutils Rocky Linux 10 9.5-8.el10_2.1
  • coreutils Rocky Linux 9 8.32-41.el9_8.1

rocky linux advisories RLSA-2026:67886RLSA-2026:66403

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-56392 updated cvss 4.4

coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values

  • Red Hat Enterprise Linux 6 coreutils, coreutils-libs Red Hat Enterprise Linux 7 coreutils
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +1 more
    fixed: vendor fix RHSA-2026:72475
  • Red Hat Cost Management 4 costmanagement/costmanagement-metrics-rhel9-operator 1790844333
    fixed: vendor fix RHSA-2026:81201
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1791460851
    fixed: vendor fix RHSA-2026:79357
  • Red Hat Enterprise Linux BaseOS (v. 8) coreutils 8.30-20.el8_10, coreutils-common 8.30-20.el8_10, coreutils-single 8.30-20.el8_10
    fixed: vendor fix RHBA-2026:47115
  • Red Hat Enterprise Linux BaseOS (v. 9) coreutils 8.32-41.el9_8.1, coreutils-single 8.32-41.el9_8.1
    fixed: vendor fix RHSA-2026:66403
  • Red Hat Enterprise Linux BaseOS (v. 10) coreutils 9.5-8.el10_2.1, coreutils-single 9.5-8.el10_2.1
    fixed: vendor fix RHSA-2026:67886
show 3 more
  • Red Hat Hardened Images coreutils 9.11-5.hum1, coreutils-common 9.11-5.hum1, coreutils-single 9.11-5.hum1
    fixed: vendor fix RHSA-2026:40724
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1789479900, rhui5/rhua-rhel9 1790242004, rhui5/haproxy-rhel9 1789479891, rhui5/installer-rhel9 1789482961, rhui5/cds-kubernetes-rhel9 1789479916
    fixed: vendor fix RHSA-2026:67956
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/jetstack-cert-manager-acmesolver-rhel9 1790223630 Red Hat Cost Management 4 costmanagement/costmanagement-metrics-operator-bundle 1790851152 Red Hat Enterprise Linux BaseOS (v. 9) coreutils-common 8.32-41.el9_8.1 Red Hat Enterprise Linux BaseOS (v. 10) coreutils-common 9.5-8.el10_2.1 Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-k8s-operator-rhel9 Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1790241954, rhui5/rhua-rhel9 1789478095, rhui5/haproxy-rhel9 1790241900, rhui5/installer-rhel9 1790241922, rhui5/cds-kubernetes-rhel9 1790241897
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CNA 4.0 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Affected packages

ecosystem package affected fixed in
julia coreutils_jll
all versions
 no fix listed

Affected products

  • GNU coreutils

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.