diff --git a/gawk-4.2.1-CVE-2026-40468.patch b/gawk-4.2.1-CVE-2026-40468.patch
new file mode 100644
index 0000000..0d3bf99
--- /dev/null
+++ b/gawk-4.2.1-CVE-2026-40468.patch
@@ -0,0 +1,96 @@
+From 36b7ed9b3b352c3719e8430081f6b0469ca70385 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Sat, 4 Apr 2026 21:45:58 +0300
+Subject: [PATCH 1/2] Minor integer overflow fixes.
+
+---
+ builtin.c | 2 +-
+ node.c    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/builtin.c b/builtin.c
+index 6927205c..b3f652f2 100644
+--- a/builtin.c
++++ b/builtin.c
+@@ -2879,7 +2879,7 @@ do_sub(int nargs, unsigned int flags)
+ 	char *repl;
+ 	char *replend;
+ 	size_t repllen;
+-	int sofar;
++	size_t sofar;
+ 	int ampersands;
+ 	int matches = 0;
+ 	Regexp *rp;
+diff --git a/node.c b/node.c
+index add959f7..d792429b 100644
+--- a/node.c
++++ b/node.c
+@@ -519,7 +519,7 @@ int
+ parse_escape(const char **string_ptr)
+ {
+ 	int c = *(*string_ptr)++;
+-	int i;
++	int64_t i;
+ 	int count;
+ 	int j;
+ 	const char *start;
+
+From ba456e26f555123752b3a61537049548403cc726 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Mon, 6 Apr 2026 10:56:38 +0300
+Subject: [PATCH 2/2] Add overflow checking in do_sub for 32 bit systems.
+
+---
+ builtin.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/builtin.c b/builtin.c
+index b3f652f2..c2c1cda1 100644
+--- a/builtin.c
++++ b/builtin.c
+@@ -2892,11 +2892,14 @@ do_sub(int nargs, unsigned int flags)
+ 	long current;
+ 	bool lastmatchnonzero;
+ 	char *mb_indices = NULL;
++	const char *fname = NULL;	// for fatal message, below
+ 
+ 	if ((flags & GENSUB) != 0) {
+ 		double d;
+ 		NODE *glob_flag;
+ 
++		fname = "gensub";
++
+ 		tmp = PEEK(3);
+ 		rp = re_update(tmp);
+ 
+@@ -2925,6 +2928,8 @@ do_sub(int nargs, unsigned int flags)
+ 		}
+ 		DEREF(glob_flag);
+ 	} else {
++		fname = ((flags & GSUB) != 0) ? "gsub" : "sub";
++
+ 		/* take care of regexp early, in case re_update is fatal */
+ 
+ 		tmp = PEEK(2);
+@@ -3041,6 +3046,21 @@ do_sub(int nargs, unsigned int flags)
+ 		 * vary since ampersand is actual text of regexp match.
+ 		 */
+ 
++		// 4/2026: This overflow check simply provides a fatal
++		// message instead of letting realloc() die later after
++		// a buffer overrun.  It simply makes the user experience better,
++		// but does not prevent gawk from dying miserably.  I suppose
++		// it's worth the trouble, but just barely.
++
++		/* uint64_t so the product is 64-bit even on 32-bit ILP32 builds */
++		uint64_t repl_contribution =
++			(uint64_t)(unsigned int)ampersands
++			* (uint64_t)(uintptr_t)(matchend - matchstart);
++		if (repl_contribution > (uint64_t)SIZE_MAX
++		    || repl_contribution > (uint64_t)SIZE_MAX - (size_t)(matchend - text)
++						- repllen - 1)
++			fatal(_("%s: replacement expansion too large"), fname);
++
+ 		/*
+ 		 * add 1 to len to handle "empty" case where
+ 		 * matchend == matchstart and we force a match on a single
diff --git a/gawk.spec b/gawk.spec
index cbeb1fa..8baee0b 100644
--- a/gawk.spec
+++ b/gawk.spec
@@ -44,7 +44,7 @@
 Name:             gawk
 Summary:          The GNU version of the AWK text processing utility
 Version:          4.2.1
-Release:          4%{?dist}
+Release:          4%{?dist}.1
 
 License:          GPLv3+ and GPLv2+ and LGPLv2+ and BSD
 
@@ -107,6 +107,10 @@ BuildRequires:    bison
 Patch000: assign-int.patch
 Patch001: proc-rv.patch
 
+# https://github.com/sysfce2/gawk/commit/062f2f2581b991362c046f7f2e238ffa34e6f8c7
+# https://github.com/sysfce2/gawk/commit/aa7272a6e1184cdd21ab8f89200219abd8053eda
+Patch002: gawk-4.2.1-CVE-2026-40468.patch
+
 # Downstream patches -- these should be always included when doing rebase:
 # ------------------
 #Patch100: example100.patch
@@ -257,6 +261,10 @@ install -m 0644 -p doc/gawkinet.{pdf,ps} %{buildroot}%{_docdir}/%{name}
 # =============================================================================
 
 %changelog
+* Mon Aug 03 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.2.1-4.1
+- Fix integer overflow in do_sub() and parse_escape() (CVE-2026-40468)
+Resolves: RHEL-222771
+
 * Fri Feb 11 2022 Jakub Martisko <jamartis@redhat.com> - 4.2.1-4
 - Rebuild with some gating tests disabled
 Resolves: rhbz#2053515