Red Hat Enterprise Linux 10
Monthly
Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash the LDAP service or achieve remote code execution after a successful SASL bind with integrity protection (SSF > 0). The flaw stems from an integer overflow in sasl_io_start_packet() that bypasses the nsslapd-maxsasliosize ceiling, enabling roughly 2 MB of attacker-controlled heap corruption. No public exploit identified at time of analysis, and the impact is amplified in FreeIPA and Red Hat Identity Management deployments where any enrolled user, host, or service principal qualifies as an authenticated attacker.
Root command injection in dracut's legacy DHCP path allows adjacent-network attackers to execute arbitrary commands inside the initramfs by sending crafted DHCP options (e.g., malicious hostname) that are written unescaped into temporary shell scripts. The flaw affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4, granting full system compromise during early boot. No public exploit identified at time of analysis, and EPSS is low (0.16%, 36th percentile), but SSVC rates technical impact as total.
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) allows unauthenticated network attackers to crash the LDAP daemon by exploiting an unchecked BER structure allocation in the dereference control plugin when the host is under memory pressure. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.09%, 25th percentile), but the unauthenticated network-reachable nature warrants prompt patching of internet-facing or business-critical directory services.
Out-of-bounds heap write in X.Org X server and Xwayland DRI2 buffer handling allows a local authenticated client to corrupt server memory by requesting multiple DRI2BufferBackLeft attachments alongside one DRI2BufferFrontLeft. Successful exploitation crashes the display server or, when the X server runs setuid root (a still-common legacy deployment), enables local privilege escalation to root. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in SyncChangeCounter() that a local authenticated attacker can trigger by orchestrating two client connections - one creating multiple SyncCounters, the other destroying them while they are being changed. On systems where the X server still runs as root (common on legacy Linux setups), successful exploitation yields root code execution; at minimum it crashes the display server. No public exploit identified at time of analysis, but the bug is confirmed by Red Hat and a fix has landed upstream in xserver.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in FreeCounter() when SyncCounter objects are destroyed across multiple client connections. Authenticated local attackers on affected Red Hat Enterprise Linux 6 through 10 systems can crash the server or escalate to root when the X server runs with elevated privileges. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.
Stack-based buffer overflow in X.Org X server and Xwayland's _XkbSetMapChecks() function allows local authenticated attackers to crash the server or potentially escalate privileges to root when the X server runs with elevated privileges. The flaw resides in CheckKeyTypes() writing to a fixed mapWidths[256] stack buffer at a client-controlled offset, affecting Red Hat Enterprise Linux versions 6 through 10. No public exploit identified at time of analysis, but an upstream fix has been merged into the xserver repository.
Local privilege escalation in the X.Org X server and Xwayland stems from a stack-based buffer overflow during font alias resolution, where a 256-byte server-side stack buffer is overrun by libXfont2 alias target names of up to 1023 bytes. An authenticated local attacker who can influence font alias files can crash the server or, when the X server runs as root, escalate to root privileges. No public exploit is identified at time of analysis and CVSS is 7.8 (Local/Low complexity/Low privileges).
Local privilege escalation in X.Org X server and Xwayland enables authenticated local users to trigger a use-after-free in miSyncDestroyFence() by racing two client connections against a shared fence object. Successful exploitation can crash the display server or escalate privileges to root when the X server runs as root, which remains common on legacy and embedded Linux deployments. No public exploit identified at time of analysis, but an upstream fix has been committed by the X.Org maintainers.
Local privilege escalation in libinput affects Red Hat Enterprise Linux 7, 8, 9, and 10 by allowing a local attacker with access to /dev/uinput to inject arbitrary udev properties via the libinput-device-group helper. Exploitation can result in root code execution through abuse of udev REMOVE_CMD properties that are run when a device is removed, mapping to CWE-78 (OS Command Injection). No public exploit identified at time of analysis, but the issue is vendor-confirmed by Red Hat.
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Certificate validation bypass in GnuTLS (as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images) lets a remote attacker defeat hostname verification: when a certificate carries an oversized Subject Alternative Name, the library incorrectly abandons SAN matching and falls back to the legacy Common Name field, accepting certificates it should reject. An attacker positioned to intercept traffic can present such a certificate to impersonate a trusted server and conduct spoofing or man-in-the-middle attacks against TLS clients that rely on GnuTLS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data.
Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Remote code execution in Cockpit's system logs UI allows authenticated users to inject shell metacharacters into unsanitized URL parameters, executing arbitrary commands on RHEL 7/8/9/10 hosts. Attack requires low-complexity exploitation by a logged-in user who can craft malicious links targeting the logs interface. No public exploit identified at time of analysis, though the vulnerable code section is publicly accessible on GitHub. EPSS data not available; CVSS 8.0 reflects high impact across confidentiality, integrity, and availability if user interaction occurs.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the host system by injecting malicious SSH options through the login endpoint. Affecting Red Hat Enterprise Linux versions 7 through 10, this critical pre-authentication vulnerability (CVSS 9.8) requires no credentials and executes code before any authentication checks occur. EPSS data not available; no confirmed active exploitation (CISA KEV) at time of analysis, though the pre-authentication nature and command injection vector present severe risk for internet-exposed Cockpit instances.
Remote denial of service via integer overflow in Corosync cluster engine affects Red Hat Enterprise Linux 7-10 and OpenShift Container Platform 4. Unauthenticated attackers can send crafted UDP packets to crash Corosync services running in totemudp/totemudpu mode (CVSS 7.5, AV:N/PR:N). EPSS data not provided; no public exploit identified at time of analysis. Impacts high-availability cluster deployments where Corosync provides quorum and messaging services.
Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memory via malformed UDP packets. Affects default totemudp/totemudpu configurations across Red Hat Enterprise Linux 7/8/9/10 and OpenShift Container Platform 4. CVSS 8.2 (High) with network attack vector, low complexity, and no authentication required. EPSS and exploitation status data not available; no public exploit identified at time of analysis. Impacts high-availability clustering infrastructure commonly used in enterprise production environments.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
Symlink-based path traversal in the buildah/copier Go package allows a crafted tar archive to create files outside the intended extraction directory when the library is used outside of Buildah by a non-root caller. Buildah's own extraction path applies chroot hardening and is explicitly not affected, so real exposure sits with downstream consumers of the package - including Red Hat Ansible Automation Platform 2 and Red Hat Enterprise Linux 10 in the published CPE data, plus other tagged Red Hat products - that unpack untrusted archives with it. Impact is integrity-only (no confidentiality or availability component in the assessed vector), the victim application must actually process the malicious archive (UI:R), EPSS is low at 0.25% (16th percentile), CISA's SSVC records exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Pacemaker Configuration System (PCS) on Red Hat Enterprise Linux 8, 9, and 10 exposes an arbitrary file-read primitive to local members of the 'haclient' group via the `pcs host auth --token` command. The pcsd daemon reads the attacker-specified file path with root privileges, base64-encodes up to 256 bytes of content, and transmits it through cluster node communication channels the attacker controls - enabling exfiltration of short sensitive files such as API tokens, symmetric keys, or credential snippets that are otherwise inaccessible to the attacker. No public exploit has been identified at time of analysis, but the attack requires only local access and group membership, making it a realistic insider-privilege escalation threat in multi-tenant HA environments.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
Flatpak's `org.freedesktop.Flatpak.SystemHelper` D-Bus service contains a TOCTOU race condition in the `Deploy()` function where a privileged `chmod` executes before OSTree repository validation completes, allowing a local low-privileged attacker to redirect symlinks to arbitrary system files within that timing window. A successful exploit can yield high-confidentiality impact (reading privileged files) and limited integrity and availability impact (CVSS C:H/I:L/A:L), as the unguarded chmod can be inherited by attacker-controlled symlink targets. No public exploit code or CISA KEV listing has been identified at time of analysis, and the High attack complexity (AC:H) reflects the precision timing required to win the race.
Heap out-of-bounds read in libtpms during TPM 2.0 state restoration allows an adjacent unauthenticated attacker to crash the swtpm process and deny TPM services to dependent virtual machines. The flaw arises in the state-blob parser: an attacker-controlled oversized skip-block length drives the internal INT32 size counter negative; subsequent bounds checks cast that counter to UINT32, wrapping it to a large positive value and bypassing the check, which then drives the parser to read memory outside the heap buffer. Vendor and upstream commit confirm the impact is denial of service only - no data corruption or information disclosure was confirmed. No public exploit or CISA KEV listing has been identified.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.
CPU exhaustion in libsoup's HTTP Range header processing affects any SoupServer deployment carrying the CVE-2025-32907 fix but not MR !550. Supplying a Range header with approximately 25,000 repeated satisfiable byte ranges triggers an O(N²) coalescing loop - each g_array_remove_index() call induces an O(N) memmove on GArray - blocking the server's event loop for roughly 90 ms per request from a single unauthenticated client. The description explicitly rules out memory corruption and information disclosure; this is a pure availability issue with no public exploit identified at time of analysis.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the `writeString()` method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
The iscsiuio DHCP parser in open-iscsi crashes when processing maliciously crafted DHCP reply packets, disrupting iSCSI storage connectivity or network boot on affected hosts. An integer underflow (CWE-191) in the IPv4/UDP DHCP reply parsing path triggers an out-of-bounds read, causing the iscsiuio process to terminate; impact is limited to availability with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and the adjacent-network attack vector constrains the realistic attacker population to the same Layer-2 segment as the target.
Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.
Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash the LDAP service or achieve remote code execution after a successful SASL bind with integrity protection (SSF > 0). The flaw stems from an integer overflow in sasl_io_start_packet() that bypasses the nsslapd-maxsasliosize ceiling, enabling roughly 2 MB of attacker-controlled heap corruption. No public exploit identified at time of analysis, and the impact is amplified in FreeIPA and Red Hat Identity Management deployments where any enrolled user, host, or service principal qualifies as an authenticated attacker.
Root command injection in dracut's legacy DHCP path allows adjacent-network attackers to execute arbitrary commands inside the initramfs by sending crafted DHCP options (e.g., malicious hostname) that are written unescaped into temporary shell scripts. The flaw affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4, granting full system compromise during early boot. No public exploit identified at time of analysis, and EPSS is low (0.16%, 36th percentile), but SSVC rates technical impact as total.
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) allows unauthenticated network attackers to crash the LDAP daemon by exploiting an unchecked BER structure allocation in the dereference control plugin when the host is under memory pressure. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.09%, 25th percentile), but the unauthenticated network-reachable nature warrants prompt patching of internet-facing or business-critical directory services.
Out-of-bounds heap write in X.Org X server and Xwayland DRI2 buffer handling allows a local authenticated client to corrupt server memory by requesting multiple DRI2BufferBackLeft attachments alongside one DRI2BufferFrontLeft. Successful exploitation crashes the display server or, when the X server runs setuid root (a still-common legacy deployment), enables local privilege escalation to root. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in SyncChangeCounter() that a local authenticated attacker can trigger by orchestrating two client connections - one creating multiple SyncCounters, the other destroying them while they are being changed. On systems where the X server still runs as root (common on legacy Linux setups), successful exploitation yields root code execution; at minimum it crashes the display server. No public exploit identified at time of analysis, but the bug is confirmed by Red Hat and a fix has landed upstream in xserver.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in FreeCounter() when SyncCounter objects are destroyed across multiple client connections. Authenticated local attackers on affected Red Hat Enterprise Linux 6 through 10 systems can crash the server or escalate to root when the X server runs with elevated privileges. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.
Stack-based buffer overflow in X.Org X server and Xwayland's _XkbSetMapChecks() function allows local authenticated attackers to crash the server or potentially escalate privileges to root when the X server runs with elevated privileges. The flaw resides in CheckKeyTypes() writing to a fixed mapWidths[256] stack buffer at a client-controlled offset, affecting Red Hat Enterprise Linux versions 6 through 10. No public exploit identified at time of analysis, but an upstream fix has been merged into the xserver repository.
Local privilege escalation in the X.Org X server and Xwayland stems from a stack-based buffer overflow during font alias resolution, where a 256-byte server-side stack buffer is overrun by libXfont2 alias target names of up to 1023 bytes. An authenticated local attacker who can influence font alias files can crash the server or, when the X server runs as root, escalate to root privileges. No public exploit is identified at time of analysis and CVSS is 7.8 (Local/Low complexity/Low privileges).
Local privilege escalation in X.Org X server and Xwayland enables authenticated local users to trigger a use-after-free in miSyncDestroyFence() by racing two client connections against a shared fence object. Successful exploitation can crash the display server or escalate privileges to root when the X server runs as root, which remains common on legacy and embedded Linux deployments. No public exploit identified at time of analysis, but an upstream fix has been committed by the X.Org maintainers.
Local privilege escalation in libinput affects Red Hat Enterprise Linux 7, 8, 9, and 10 by allowing a local attacker with access to /dev/uinput to inject arbitrary udev properties via the libinput-device-group helper. Exploitation can result in root code execution through abuse of udev REMOVE_CMD properties that are run when a device is removed, mapping to CWE-78 (OS Command Injection). No public exploit identified at time of analysis, but the issue is vendor-confirmed by Red Hat.
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Certificate validation bypass in GnuTLS (as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images) lets a remote attacker defeat hostname verification: when a certificate carries an oversized Subject Alternative Name, the library incorrectly abandons SAN matching and falls back to the legacy Common Name field, accepting certificates it should reject. An attacker positioned to intercept traffic can present such a certificate to impersonate a trusted server and conduct spoofing or man-in-the-middle attacks against TLS clients that rely on GnuTLS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data.
Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Remote code execution in Cockpit's system logs UI allows authenticated users to inject shell metacharacters into unsanitized URL parameters, executing arbitrary commands on RHEL 7/8/9/10 hosts. Attack requires low-complexity exploitation by a logged-in user who can craft malicious links targeting the logs interface. No public exploit identified at time of analysis, though the vulnerable code section is publicly accessible on GitHub. EPSS data not available; CVSS 8.0 reflects high impact across confidentiality, integrity, and availability if user interaction occurs.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the host system by injecting malicious SSH options through the login endpoint. Affecting Red Hat Enterprise Linux versions 7 through 10, this critical pre-authentication vulnerability (CVSS 9.8) requires no credentials and executes code before any authentication checks occur. EPSS data not available; no confirmed active exploitation (CISA KEV) at time of analysis, though the pre-authentication nature and command injection vector present severe risk for internet-exposed Cockpit instances.
Remote denial of service via integer overflow in Corosync cluster engine affects Red Hat Enterprise Linux 7-10 and OpenShift Container Platform 4. Unauthenticated attackers can send crafted UDP packets to crash Corosync services running in totemudp/totemudpu mode (CVSS 7.5, AV:N/PR:N). EPSS data not provided; no public exploit identified at time of analysis. Impacts high-availability cluster deployments where Corosync provides quorum and messaging services.
Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memory via malformed UDP packets. Affects default totemudp/totemudpu configurations across Red Hat Enterprise Linux 7/8/9/10 and OpenShift Container Platform 4. CVSS 8.2 (High) with network attack vector, low complexity, and no authentication required. EPSS and exploitation status data not available; no public exploit identified at time of analysis. Impacts high-availability clustering infrastructure commonly used in enterprise production environments.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
Symlink-based path traversal in the buildah/copier Go package allows a crafted tar archive to create files outside the intended extraction directory when the library is used outside of Buildah by a non-root caller. Buildah's own extraction path applies chroot hardening and is explicitly not affected, so real exposure sits with downstream consumers of the package - including Red Hat Ansible Automation Platform 2 and Red Hat Enterprise Linux 10 in the published CPE data, plus other tagged Red Hat products - that unpack untrusted archives with it. Impact is integrity-only (no confidentiality or availability component in the assessed vector), the victim application must actually process the malicious archive (UI:R), EPSS is low at 0.25% (16th percentile), CISA's SSVC records exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Pacemaker Configuration System (PCS) on Red Hat Enterprise Linux 8, 9, and 10 exposes an arbitrary file-read primitive to local members of the 'haclient' group via the `pcs host auth --token` command. The pcsd daemon reads the attacker-specified file path with root privileges, base64-encodes up to 256 bytes of content, and transmits it through cluster node communication channels the attacker controls - enabling exfiltration of short sensitive files such as API tokens, symmetric keys, or credential snippets that are otherwise inaccessible to the attacker. No public exploit has been identified at time of analysis, but the attack requires only local access and group membership, making it a realistic insider-privilege escalation threat in multi-tenant HA environments.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
Flatpak's `org.freedesktop.Flatpak.SystemHelper` D-Bus service contains a TOCTOU race condition in the `Deploy()` function where a privileged `chmod` executes before OSTree repository validation completes, allowing a local low-privileged attacker to redirect symlinks to arbitrary system files within that timing window. A successful exploit can yield high-confidentiality impact (reading privileged files) and limited integrity and availability impact (CVSS C:H/I:L/A:L), as the unguarded chmod can be inherited by attacker-controlled symlink targets. No public exploit code or CISA KEV listing has been identified at time of analysis, and the High attack complexity (AC:H) reflects the precision timing required to win the race.
Heap out-of-bounds read in libtpms during TPM 2.0 state restoration allows an adjacent unauthenticated attacker to crash the swtpm process and deny TPM services to dependent virtual machines. The flaw arises in the state-blob parser: an attacker-controlled oversized skip-block length drives the internal INT32 size counter negative; subsequent bounds checks cast that counter to UINT32, wrapping it to a large positive value and bypassing the check, which then drives the parser to read memory outside the heap buffer. Vendor and upstream commit confirm the impact is denial of service only - no data corruption or information disclosure was confirmed. No public exploit or CISA KEV listing has been identified.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.
CPU exhaustion in libsoup's HTTP Range header processing affects any SoupServer deployment carrying the CVE-2025-32907 fix but not MR !550. Supplying a Range header with approximately 25,000 repeated satisfiable byte ranges triggers an O(N²) coalescing loop - each g_array_remove_index() call induces an O(N) memmove on GArray - blocking the server's event loop for roughly 90 ms per request from a single unauthenticated client. The description explicitly rules out memory corruption and information disclosure; this is a pure availability issue with no public exploit identified at time of analysis.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the `writeString()` method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
The iscsiuio DHCP parser in open-iscsi crashes when processing maliciously crafted DHCP reply packets, disrupting iSCSI storage connectivity or network boot on affected hosts. An integer underflow (CWE-191) in the IPv4/UDP DHCP reply parsing path triggers an out-of-bounds read, causing the iscsiuio process to terminate; impact is limited to availability with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and the adjacent-network attack vector constrains the realistic attacker population to the same Layer-2 segment as the target.
Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.