CVE-2026-56391

Name of the Vulnerable Software and Affected Versions GNU coreutils (affected versions not specified)

Description GNU coreutils uniq contains an out-of-bounds read issue caused by incorrect handling of multibyte input when the -w (--check-chars) option is used. The find field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, which results in an inflated length value. This value is subsequently used in a memcmp operation, leading to reads beyond the allocated buffer when processing crafted multibyte input. This behavior can cause a crash and potential exposure of adjacent heap memory when the utility is run with attacker-provided arguments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.