GNU coreutils uniq, unexpand flaws patched
CERT Polska coordinated disclosure of two memory-safety bugs in GNU coreutils' uniq and unexpand utilities that can crash programs or expose/corrupt heap memory.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities in GNU coreutils reported by AFINE Team researchers. CVE-2026-56391 affects the uniq utility's -w/--check-chars option, where the find_field() function incorrectly calculates multibyte character length by repeatedly processing a fixed pointer rather than advancing through input, inflating a length value later used in memcmp, resulting in an out-of-bounds read and potential heap memory exposure when processing attacker-crafted multibyte input.
CVE-2026-56392 affects the unexpand utility, where an integer overflow in the buffer allocation size calculation for large tab stop (-t) values can cause the multiplication to wrap around, producing an undersized buffer. Subsequent writes then exceed the allocated heap memory, potentially yielding a write primitive depending on memory layout when crafted -t arguments are supplied.
Both issues require an attacker to control command-line arguments passed to these coreutils binaries (a local or script-injection style precondition rather than remote network exploitation) and have been fixed upstream via specific commits. No in-the-wild exploitation is reported; this is a standard coordinated disclosure of memory-safety bugs in widely used open-source utilities.
Mentioned in this report
Detection guidance
Unexpand Executed With Anomalously Large -t Tab Stop Value
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects invocation of coreutils unexpand with an extremely large numeric -t/--tabs argument, the pattern needed to trigger the CVE-2026-56392 integer-overflow buffer under-allocation leading to heap overwrite; legitimate tab-stop values are small (single/double digit), so very large values are a strong signal of exploit attempt rather than normal formatting use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unexpand Executed With Anomalously Large -t Tab Stop Value
description: Detects execution of the unexpand utility with an unusually large numeric
argument to -t/--tabs. CVE-2026-56392 is triggered by a tab-stop value large enough
that the buffer-size multiplication overflows, producing an undersized allocation
and a subsequent heap write past its bounds. Legitimate tab-stop configuration uses
small integers (commonly 2-8, rarely into the low hundreds), so multi-digit values
in the thousands/millions or larger are anomalous and indicate a crafted exploitation
attempt rather than normal text reformatting. This rule targets the command-line
argument pattern required to reach the vulnerable code path, not a specific payload
or file artefact.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /unexpand
CommandLine|re: (-t\s*|--tabs=)[0-9]{6,}
condition: selection
falsepositives:
- Automated build/CI pipelines or test harnesses that pass fuzzed/edge-case arguments
to coreutils intentionally
- Scripts generated by other tools that compute tab widths programmatically and occasionally
pass unexpectedly large values due to upstream bugs unrelated to this CVE
level: medium
id: cbd92e2c-a72e-50e2-9b13-ae9ef0e1118f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-56391
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs