CVE-2026-56392: 
Wolfi Analyse et atténuation des vulnérabilités

CVE-2026-56392 is a heap-based buffer overflow vulnerability in the unexpand utility of GNU coreutils, caused by an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer; subsequent writes then exceed the allocated memory, leading to an out-of-bounds heap write. All GNU coreutils versions up to and including 9.11 are affected. The vulnerability was disclosed on July 24, 2026, assigned by CERT-PL, and carries a CVSS v4.0 base score of 1.8 (Low) (GitHub Advisory, EUVD).

The root cause is an integer overflow (CAPEC-92: Forced Integer Overflow) during heap buffer allocation in the unexpand utility, classified as CWE-122 (Heap-based Buffer Overflow). When a user supplies an excessively large tab stop value via the -t argument, the internal multiplication to compute the required buffer size wraps around, producing an undersized allocation. Subsequent writes to this buffer exceed its bounds, resulting in an out-of-bounds heap write that can crash the process or, depending on memory layout, yield a heap write primitive potentially usable for code execution. The attack vector is local and requires active user interaction (the victim or attacker must invoke unexpand with attacker-controlled arguments), with attack requirements classified as "Present" (GitHub Advisory, CERT-PL).

Successful exploitation can cause the unexpand process to crash (denial of availability) or, in favorable memory layout conditions, achieve an arbitrary heap write primitive that could potentially lead to local code execution. Confidentiality impact is assessed as none, while integrity and availability of the vulnerable system are rated low. Because unexpand is a standard command-line utility without elevated privileges in typical deployments, the blast radius is limited to the invoking user's context, with no direct impact on subsequent systems (GitHub Advisory, EUVD).

1. Identify target: Confirm the target system is running GNU coreutils ≤ 9.11 with the unexpand utility available and accessible to the attacker or a user whose input the attacker can influence.
2. Craft malicious argument: Prepare a large tab stop value for the -t flag designed to trigger integer overflow during buffer size calculation (e.g., a value near the maximum of the integer type used internally).
3. Invoke unexpand: Execute unexpand -t <large_value> <input_file> with the crafted argument, either directly or by inducing a user or script to run it with attacker-controlled input.
4. Trigger overflow: The multiplication for buffer allocation wraps around, producing an undersized heap buffer. Subsequent writes to the buffer exceed its bounds.
5. Achieve impact: Depending on heap memory layout, the out-of-bounds write either crashes the process (denial of service) or, in a controlled environment, may be leveraged as a heap write primitive for further exploitation (GitHub Advisory, CERT-PL).

• Process: Unexpected crashes or segmentation faults from the unexpand process; core dump files generated in the working directory or /var/crash/.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing unexpand terminated with signal 11 (SIGSEGV) or signal 6 (SIGABRT); entries from heap corruption detection (e.g., glibc malloc abort messages such as corrupted size vs. prev_size).
• File System: Unexpected core dump files (e.g., core, core.<pid>) in directories where unexpand was invoked.
• Command History: Shell history entries showing unexpand invoked with unusually large numeric -t arguments.

Apply the upstream fix available in GNU coreutils commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d, which corrects the integer overflow in buffer size calculation. Users should update to a patched release of GNU coreutils once their distribution ships one. As a workaround, restrict execution of unexpand to trusted users only and validate or sanitize -t tab stop arguments in any scripts or applications that pass user-controlled input to the utility (GitHub Advisory, GNU coreutils commit).

The vulnerability was discovered and reported by CERT-PL, which published a technical post covering related GNU coreutils issues. Coverage has been limited to vulnerability aggregator sites and threat intelligence feeds, with no notable vendor statements or significant community discussion beyond initial disclosure (CERT-PL, Malware News).