GNU coreutils uniq, unexpand flaws patched
CERT Polska coordinated disclosure of two memory-safety bugs in GNU coreutils' uniq and unexpand utilities that can crash programs or expose/corrupt heap memory.
CERT Polska disclosed two vulnerabilities in GNU coreutils reported by AFINE Team researchers. CVE-2026-56391 affects the uniq utility's -w/--check-chars option, where the find_field() function incorrectly calculates multibyte character length by repeatedly processing a fixed pointer rather than advancing through input, inflating a length value later used in memcmp, resulting in an out-of-bounds read and potential heap memory exposure when processing attacker-crafted multibyte input.
CVE-2026-56392 affects the unexpand utility, where an integer overflow in the buffer allocation size calculation for large tab stop (-t) values can cause the multiplication to wrap around, producing an undersized buffer. Subsequent writes then exceed the allocated heap memory, potentially yielding a write primitive depending on memory layout when crafted -t arguments are supplied.
Both issues require an attacker to control command-line arguments passed to these coreutils binaries (a local or script-injection style precondition rather than remote network exploitation) and have been fixed upstream via specific commits. No in-the-wild exploitation is reported; this is a standard coordinated disclosure of memory-safety bugs in widely used open-source utilities.
Mentioned in this report
Detection guidance
Unexpand Executed With Anomalously Large -t Tab Stop Value
Detects invocation of coreutils unexpand with an extremely large numeric -t/--tabs argument, the pattern needed to trigger the CVE-2026-56392 integer-overflow buffer under-allocation leading to heap overwrite; legitimate tab-stop values are small (single/double digit), so very large values are a strong signal of exploit attempt rather than normal formatting use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unexpand Executed With Anomalously Large -t Tab Stop Value
description: Detects execution of the unexpand utility with an unusually large numeric
argument to -t/--tabs. CVE-2026-56392 is triggered by a tab-stop value large enough
that the buffer-size multiplication overflows, producing an undersized allocation
and a subsequent heap write past its bounds. Legitimate tab-stop configuration uses
small integers (commonly 2-8, rarely into the low hundreds), so multi-digit values
in the thousands/millions or larger are anomalous and indicate a crafted exploitation
attempt rather than normal text reformatting. This rule targets the command-line
argument pattern required to reach the vulnerable code path, not a specific payload
or file artefact.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /unexpand
CommandLine|re: (-t\s*|--tabs=)[0-9]{6,}
condition: selection
falsepositives:
- Automated build/CI pipelines or test harnesses that pass fuzzed/edge-case arguments
to coreutils intentionally
- Scripts generated by other tools that compute tab widths programmatically and occasionally
pass unexpectedly large values due to upstream bugs unrelated to this CVE
level: medium
id: cbd92e2c-a72e-50e2-9b13-ae9ef0e1118f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-56391
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free