CVE-2026-56391 Out‑of‑bounds Read in GNU coreutils
An out-of-bounds read in GNU coreutils uniq allows attackers to cause crashes or expose heap memory via crafted multibyte input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-56391?
CVE-2026-56391 is a medium-severity memory corruption vulnerability in GNU coreutils, published on 24 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.
When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Weakness: CWE-125
Which versions are affected by CVE-2026-56391?
It affects 1 product.
Linux distribution packages (13)
coreutils Red Hat:hummingbird:1 | All versions | 0:9.11-5.1.hum1 |
coreutils-common Red Hat:hummingbird:1 | All versions | 0:9.11-5.1.hum1 |
coreutils-single Red Hat:hummingbird:1 | All versions | 0:9.11-5.1.hum1 |
coreutils SUSE:Linux Enterprise Server 16.0 | All versions | 9.6-160000.3.1 |
coreutils-single SUSE:Linux Enterprise Server 16.0 | All versions | 9.6-160000.3.1 |
coreutils-systemd SUSE:Linux Enterprise Server 16.0 | All versions | 9.6-160000.3.1 |
coreutils SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 9.6-160000.3.1 |
coreutils-single SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 9.6-160000.3.1 |
coreutils-systemd SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 9.6-160000.3.1 |
coreutils openSUSE:Leap 16.0 | All versions | 9.6-160000.3.1 |
coreutils-single openSUSE:Leap 16.0 | All versions | 9.6-160000.3.1 |
coreutils-systemd openSUSE:Leap 16.0 | All versions | 9.6-160000.3.1 |
coreutils-testsuite openSUSE:Leap 16.0 | All versions | 9.6-160000.3.1 |
Products include Gnu Coreutils.
How do I fix CVE-2026-56391?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-56391 being exploited?
There is no known exploitation of CVE-2026-56391 in the wild and no public exploit code.
Other vulnerabilities in GNU coreutils
Sources
Also known as DEBIAN-CVE-2026-56391, ECHO-3699-27c7-123e, GHSA-7xvj-m9x7-qgxq, JLSEC-2026-1195, MGASA-2026-0439, RHSA-2026:46515 and 3 more.