Description
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.
When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.
When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.
This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | coreutils | ≤ 9.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | coreutils | No fix yet | — |
| Debian 13 | coreutils | No fix yet | — |
| Debian 12 | coreutils | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | coreutils +1 | 9.5-8.el10_2.1 | RHSA-2026:67886 |
| RHEL 9 | coreutils +1 | 8.32-41.el9_8.1 | RHSA-2026:66403 |
| RHEL 8 | coreutils +2 | 8.30-20.el8_10 | RHBA-2026:47115 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | coreutils +2 | 9.11-5.hum1 | RHSA-2026:40724 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | coreutils +2 | 9.5-8.el10_2.1 | ALSA-2026:67886 |
| AlmaLinux 9 | coreutils +2 | 8.32-41.el9_8.1 | ALSA-2026:66403 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | coreutils | 9.5-8.el10_2.1 | RLSA-2026:67886 |
| Rocky Linux 9 | coreutils | 8.32-41.el9_8.1 | RLSA-2026:66403 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | coreutils | 9.11-5.1 | openSUSE-SU-2026:11764-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | coreutils +2 | 9.5-8.0.1.el10_2.1 | ELSA-2026-67886 |
Advisories 11
- ALSA-2026:66403 Moderate: coreutils security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67886 Moderate: coreutils security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3319 Red Hat Enterprise Linux (GNU coreutils unexpand): Schwachstelle ermöglicht DoS und Manipulation von Dateien BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2026:67886 Red Hat Security Advisory: coreutils security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:66403 Red Hat Security Advisory: coreutils security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:40724 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHBA-2026:47115 Red Hat Bug Fix Advisory: coreutils bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RLSA-2026:67886 Moderate: coreutils security update Rocky Linux Security Advisories · Sep 17, 2026
- ELSA-2026-67886 Moderate: coreutils security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 16, 2026
- openSUSE-SU-2026:11764-1 coreutils-9.11-5.1 on GA media SUSE / openSUSE Security Updates · Sep 13, 2026
- RLSA-2026:66403 Moderate: coreutils security update Rocky Linux Security Advisories · Sep 11, 2026