EUVD-2026-54413
GHSA-6x8p-h5fj-5ppr
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local or RPC-equivalent access with no privileges needed; pure DoS impact (A:H) with no confidentiality or integrity effect; 32-bit constraint is a target-architecture property, not an attacker-controlled complexity factor.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.
AnalysisAI
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
p11-kit is a shared library and RPC daemon that provides a standard way to load and enumerate PKCS#11 modules on Linux systems; it is a common dependency of GnuTLS, NSS, and related cryptographic stacks on RHEL-family distributions. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow), triggered by an integer overflow during memory allocation for nested PKCS#11 attribute structures received over the p11-kit RPC channel. On 32-bit systems, pointer and size_t values are 4 bytes wide, making arithmetic overflow significantly easier to induce than on 64-bit systems - a specially crafted nesting depth or attribute count causes the computed allocation size to wrap around, resulting in an undersized heap buffer that is subsequently written past its bounds. CPE data confirms the affected software is present across the full supported RHEL product matrix: cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10, red_hat_hardened_images, and red_hat_openshift_container_platform_4.
RemediationAI
The primary remediation is to apply the updated p11-kit package once Red Hat publishes a fixed RPM for the relevant RHEL version; monitor https://access.redhat.com/security/cve/CVE-2026-18938 and https://bugzilla.redhat.com/show_bug.cgi?id=2478995 for patch availability and exact fix versions. No patched version number was confirmed in the available input data, so consumers should subscribe to Red Hat errata notifications. As a compensating control on 32-bit systems where patching is not immediately possible, restrict access to the p11-kit RPC socket using filesystem permissions or SELinux policy to limit which local users or processes can reach the RPC channel - this raises the effective privilege bar for exploitation, though it does not eliminate the vulnerability. Organizations that do not require p11-kit RPC functionality can disable the p11-kit-server daemon to remove the RPC attack surface entirely, with the trade-off that remote PKCS#11 module sharing will be unavailable. As the vulnerability has no impact on 64-bit systems, no action is required on standard 64-bit RHEL or OpenShift deployments.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today