Red Hat Enterprise Linux 10
Monthly
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
dnsmasq's DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option when the server processes a single DHCPv6 packet from an attacker on the same local link. The over-read byte is neither returned to the client nor logged, and no crash or confirmed information disclosure has been demonstrated; the independent assessment scores confidentiality, integrity, and availability impact as none, so real-world risk is low despite the genuine memory-safety defect. No CISA KEV entry or public exploit code was identified at time of analysis.
DHCP lease metadata disclosure in dnsmasq (CVE-2026-93010) occurs when the DHCP leasequery feature has been switched on without an allow-list of permitted query sources, letting any host on the local network pull lease records - assigned IP addresses, MAC addresses, hostnames and related lease metadata. The package is shipped across Red Hat Enterprise Linux 6 through 10 and is bundled into Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform builds, but the vulnerable feature is off unless an administrator explicitly enables it. Severity is capped at a confidentiality-only leak (CVSS 4.3, adjacent-network attack vector), and no public exploit code or active exploitation has been identified at time of analysis.
TFTP file substitution in dnsmasq allows an attacker on the local network to make a later client receive stale, previously cached transfer data instead of the file it requested; in PXE network-boot deployments this can substitute attacker-chosen boot content for a victim machine, giving both confidentiality and integrity impact. The flaw only exists when dnsmasq is running with its TFTP server feature enabled (a non-default configuration used for network boot), requires adjacent-network access (AV:A) with no authentication (PR:N) and no user interaction (UI:N), but is rated high complexity (AC:H) because the attacker cannot control when another client will request the same file and pick up the cached response. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the vendor-reported CVSS 3.1 score is 6.8, making this a moderate, situational issue rather than an emergency; Red Hat tracks it for remediation within the current monthly cycle.
Denial of service against dnsmasq's TCP DNS service: remote attackers can occupy the entire small fixed pool of TCP child processes by holding idle connections open to port 53, which blocks new TCP DNS queries and any DNSSEC validation that depends on TCP fallback. The flaw is packaged in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform 13 (Queens) and 18.0, so any of those deployments exposing TCP/53 to untrusted networks is in scope. Impact is confined to availability and is time-bounded rather than permanent - UDP resolution keeps working and occupied slots are released after a fixed lifetime - and no public exploit identified at time of analysis.
dnsmasq builds that include the DNSSEC validator and have validation enabled at runtime can write a few bytes past an internal domain-name buffer when converting names to and from DNS wire format, corrupting adjacent heap metadata. Only deployments where DNSSEC support was compiled in and DNSSEC validation is switched on are exposed; the default dnsmasq build omits DNSSEC entirely, and exploitation further requires an attacker to make the resolver validate a crafted DNSSEC response, for example through a spoofed or attacker-controlled answer for a signed name. Rated CVSS 5.3 (integrity-only, low impact) and no public exploit identified at time of analysis; the priority signal is this_month, not immediate action.
A DNS cache-poisoning flaw in dnsmasq (CWE-345, insufficient verification of data authenticity) lets a malicious or compromised upstream resolver inject cached records for names outside its authoritative zone when dnsmasq follows a CNAME in a response. Only split-DNS deployments that forward specific domains to a designated upstream are realistically exposed, since the attacker must already occupy that trusted upstream position; standard single-forwarder or root-hint setups are far less affected. Impact is integrity-only (attacker-chosen addresses returned to later clients), rated CVSS 6.8 with AC:H, and no public exploit code or KEV entry was identified at time of analysis, so priority follows the vendor's this-month cadence rather than emergency response.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
gssproxy can be persistently crashed by any local user who can reach its Unix domain socket: a GSSX_INIT_SEC_CONTEXT request that omits the target_name field triggers a NULL pointer dereference in the daemon. The issue affects gssproxy deployments on Red Hat Enterprise Linux 7, 8, 9, and 10 and is listed for Red Hat OpenShift Container Platform 4; because gssproxy does not automatically restart, Kerberized NFS and IdM services that depend on it can be disrupted until an administrator intervenes. No public exploit identified at time of analysis.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
libslirp user-mode networking can disclose the host's real IP address to a guest when an ICMP echo request is handled through the fallback path and the reply length is not updated to match the actual data received. The flaw affects libslirp as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat OpenShift Container Platform 4, with exposure limited to guests using slirp-style user-mode networking rather than bridged or tap networking. Rated CVSS 3.5 with a monitor priority, exploitation requires a guest-level user able to send ICMP echo requests plus a host-side condition the attacker does not control, and no public exploit has been identified at time of analysis.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
An out-of-bounds read in libmodulemd's modulemd v2 rpm-map YAML serialization path can crash applications that process crafted module metadata, producing a local denial of service. The bug is triggered only when the metadata declares multiple digest algorithm types and is serialized through the affected path; default single-digest metadata does not trigger it. The assessed impact is availability-only, with no confirmed code execution or data exposure, and no public exploit code or CISA KEV entry was identified at time of analysis.
Stack exhaustion in libmodulemd's xmd (extended metadata) parser lets anyone who can place crafted modulemd YAML in front of a consuming process crash it or exhaust its resources, an availability-only denial of service (CVSS 6.2, C:N/I:N/A:H). The defect is in the recursive YAML mapping/sequence helpers that convert xmd content into nested GVariant values with no recursion-depth or node-count ceiling, so deeply nested input overflows the stack. Affected builds ship in Red Hat Enterprise Linux 8, 9 and 10, Red Hat Hardened Images, and OpenShift Container Platform 4; the vector AV:L/PR:N/UI:N means the attacker must first get the malicious metadata onto a host that parses it (for example an attacker-controlled or third-party module repository consumed by DNF/libdnf), after which no authentication or user interaction is required. No public exploit code and no confirmed active exploitation were identified in the available intelligence at time of analysis.
Denial of service in libmodulemd can be triggered when a build compiled with rpmio support parses a highly compressible modulemd YAML file; the custom decompression read handler does not cap cumulative decompressed output before parsing, allowing CPU and memory exhaustion that can hang or crash the consuming process. The issue is scored CVSS 6.2 with a LOCAL vector, requires no authentication or user interaction once a malicious file reaches the parser, and is associated by CPE data with Red Hat Enterprise Linux 8, 9, and 10 plus related OpenShift and hardened image products. No public exploit code or CISA KEV-listed active exploitation was identified in the supplied intelligence.
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
Local credential disclosure in cockpit-machines, the Cockpit web module for managing libvirt/KVM virtual machines on Red Hat Enterprise Linux 9 and 10, exposes a guest VM's VNC console password to other unprivileged users on the same host. When an operator saves VNC console settings, the configured password is handed to an underlying system utility as a command-line argument, so any local user able to inspect another user's process entries can read the secret during that brief window. Exploitation requires an already-authenticated local account (PR:L), a host without hidepid-style process hiding, and a concurrent victim save action (UI:R); no public exploit code exists and the flaw is not in CISA KEV.
Information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 lets a local unprivileged user capture RHSM authentication tokens from the command line of a short-lived image-retrieval helper process when cross-user process inspection is enabled. The attacker needs a local shell account and a concurrent image-retrieval operation by another user; stolen tokens can be used against RHSM resources only until they expire. This is a moderate-risk, low-urgency issue with no public exploit identified at time of analysis, and it does not provide remote access, code execution, or integrity/availability impact.
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the GStreamer ASF demuxer (gst-plugins-ugly), rated CVSS 6.5, allows a crafted ASF, WMV, or WMA file to drive an oversized heap allocation because an attacker-controlled Simple Index entry count is not bounded by the object's actual payload. The issue affects gst-plugins-ugly packages in Red Hat Enterprise Linux 7, 8, 9, and 10; exploitation requires a victim to open or preview the malicious media file, with an unauthenticated network vector and user interaction required, and impact is limited to availability loss with no code execution or data exposure. No public exploit identified at time of analysis.
Local privilege escalation in Red Hat rhc's rhc-canonical-facts.service lets an attacker who has already compromised the privileged yggdrasil service account pre-plant a symbolic link so the root-run unit follows it and changes ownership of an arbitrary file, enabling escalation to root. The flaw is CWE-59 link following and affects rhc installations on Red Hat Enterprise Linux 7, 8, 9, and 10 per CPE data; exploitation is local-only and requires high privileges (CVSS PR:H), so risk is confined to systems where the yggdrasil account is already reachable. No public exploit code was identified in the provided sources at time of analysis, and no CISA KEV or EPSS signal was supplied.
Repeated state-notification requests sent to a network-reachable rpc.statd service in nfs-utils cause memory allocated during callback processing to never be released, producing continuous memory growth that can degrade or crash the service and exhaust host resources. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but exploitation is not trivial: a single request is insufficient because the attacker must sustain a stream of requests long enough to exhaust memory, which is why the vector carries AC:H and the impact is availability-only (C:N/I:N/A:H, base score 5.9). Exposure is limited in practice because rpc.statd only runs when NFSv3 locking services are active and is normally bound to internal or trusted networks rather than the public internet, so firewalled or default deployments are not reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; this is a genuine but moderate-priority availability issue rather than a top-tier emergency, and affected services can be recovered by a restart.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Denial of service in libtirpc allows an authenticated remote RPC client to exhaust server memory by sending oversized wrapped-data requests to an RPC service that is configured with RPCSEC_GSS integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection. Only services explicitly running in that non-default, Kerberos-backed mode are exposed - most commonly NFS deployments on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - and the impact is availability-only (CVSS 6.5, A:H) with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it warrants medium-priority patch tracking rather than emergency response, although affected RPC services can become unstable or terminate under the resource exhaustion.
Local denial of service in the nfs-utils fsidd daemon affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4; an authenticated local user with access to the fsidd Unix domain socket can send a malformed request that omits required arguments, triggering a CWE-617 assertion failure and crashing the daemon. The service remains unavailable for filesystem identifier lookups until restarted, giving this a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis.
Argument injection in libblockdev's NTFS and VFAT label-setting routines lets a local, unprivileged user smuggle command-line flags into the ntfslabel and fatlabel utilities through a filesystem label that begins with a dash. The vulnerable paths (bd_fs_ntfs_set_label() and bd_fs_vfat_set_label()) are reachable without administrator authentication via the udisks2 Filesystem.SetLabel() D-Bus method, but exploitation is strictly local and the assessed impact is low integrity only - no confidentiality or availability loss and no privilege escalation. No public exploit code has been identified at time of analysis, and the low CVSS score (3.3, AV:L/PR:L/I:L) reflects the limited blast radius rather than an unexplored attack surface.
Improper boundary validation of metadata slot values in luksmeta allows an attacker who can supply or modify a LUKS disk header to redirect wipe or load operations outside the intended metadata area, overwriting or zeroing encrypted payload data and causing persistent data loss and corrupted storage. The attack is confined to a local vector and requires high privileges - root-level write access to the raw block device, or inducing an administrator to process an attacker-supplied untrusted disk image whose header carries out-of-range slot values together with valid checksums. The impact is limited to integrity and availability, with no information disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the moderate CVSS of 6.0 reflects the substantial privilege barrier rather than the severity of the data-loss outcome.
An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
Host-side denial of service and potential memory corruption in DPDK's lib/vhost arise because memory-region sizes are not adequately validated before mmap during vhost memory-region setup (CWE-770). The affected code ships to customers through Red Hat Fast Datapath for RHEL 8, 9 and 10, and therefore reaches Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift Container Platform 4 and Red Hat OpenStack Platform 13 (Queens) deployments that use DPDK vhost-user acceleration. An attacker who controls a connected vhost-user frontend - typically a guest VM or a process holding the vhost-user socket - can crash the host (CVSS 6.5, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation.
A time-of-check/time-of-use race in the DPDK vhost library's handling of virtio indirect descriptor tables allows an attacker who already controls a guest VM attached to a DPDK vhost-user backend to crash or disrupt the host vhost process by mutating the descriptor table length between the host's two reads from guest memory, or by supplying an out-of-range next index against a small host-side copy in the vDPA relay path. Exploitation requires local/guest-level low privilege (PR:L) and is heavily timing-dependent (AC:H), and the impact is confined to availability - the out-of-bounds bytes are consumed internally as descriptor fields for GPA translation and are never returned to the guest as payload, so no confidentiality or integrity loss is assessed. This is a moderate, defense-in-depth-class residual of the CVE-2018-1059 fix rather than an urgent priority, and no public exploit code was identified at time of analysis.
Local authenticated attackers can retrieve LUKS disk-encryption passphrases from hosts using the Clevis PKCS#11 pin because the clevis-pkcs11-afunix-socket-unlock daemon writes passphrases in plaintext to a world-readable log file. This affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4 deployments where this non-default disk-unlock configuration is in use. No public exploit code has been identified at time of analysis; exploitation requires an existing low-privileged local account and prior logging of a LUKS unlock passphrase.
An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.
Local attackers can exploit improperly secured AF_UNIX sockets in the clevis PKCS#11 pin to inject arbitrary device/key pairs or intercept LUKS passphrases, potentially gaining unauthorized access to encrypted disks. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. Exploitation requires an authenticated local user and a permissive process umask; no public exploit code or active exploitation has been identified, and the issue is rated modest priority due to the local-only attack vector and dependency on non-default umask settings.
Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.
A stack-based out-of-bounds write in GNOME Remote Desktop's VNC TLS read path, as shipped in Red Hat Enterprise Linux 8, 9, and 10, can crash the service and cause denial of service. An unauthenticated remote attacker (per the CVSS vector PR:N) who can reach an enabled VNC TLS listener and drive the connection into a peek/read size mismatch can corrupt memory on the stack; the vector rates this CVSS 5.9 with availability-only impact (C:N/I:N/A:H) and high attack complexity (AC:H), reflecting that the mismatch is non-trivial to trigger reliably. The vulnerable configuration is not default: remote desktop sharing must be explicitly enabled with the VNC backend and a reachable TLS listener, which is uncommon on headless or server RHEL installs; no public exploit code and no confirmed active exploitation were identified at time of analysis, and this should be handled as a routine patch rather than an emergency.
Crafted ISO-2022 encoded text passed to the m17n-lib decoder can trigger an uninitialized stack memory read, potentially leaking small amounts of process memory if the application then returns or displays the decoded output to the attacker. The issue is rated low severity (CVSS 2.5, AV:L/AC:H/UI:R, unauthenticated per vector PR:N) and affects multilanguage library builds shipped across Red Hat Enterprise Linux 6 through 10, though any application embedding m17n-lib's ISO-2022 handling is in scope. No public exploit identified at time of analysis; risk is gated by the fact that the deploying application must both decode attacker-supplied ISO-2022 input and reflect the decoded result back, which is uncommon in typical installations.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
Data corruption in luksmeta allows a local attacker who already holds administrative privileges to damage or destroy metadata and encrypted payload data stored on a Linux Unified Key Setup (LUKS) device when a new metadata entry is saved. Because faulty free-space boundary calculations and flawed overlap detection can let new records be written past the available area or on top of existing ones, integrity is fully compromised though confidentiality is not (CVSS 5.1, AV:L/AC:L/PR:H/UI:N/C:N/I:H/A:L), and affected volumes may become inaccessible. Exploitation requires local host access with privileges sufficient to run luksmeta and write to the device; there is no remote or unauthenticated vector, no public exploit identified at time of analysis, and no confirmed active exploitation (not in CISA KEV), so impact is realistically limited to accidental or deliberate corruption by a privileged operator. The issue affects luksmeta as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10, plus Red Hat OpenShift Container Platform 4 through the underlying RHCOS userland.
Information disclosure in flatpak-builder lets a crafted build manifest read sensitive host files and embed their contents into resulting build artifacts, because source download definitions that specify local file:// URIs bypass the tool's directory confinement checks. Exploitation requires a developer or CI system to actually process the untrusted manifest (user interaction per CVSS UI:R), so it is not remotely triggerable without someone initiating a build; no public exploit identified at time of analysis. Red Hat rates it moderate at CVSS 6.1, and the affected package ships in Red Hat Enterprise Linux 8, 9, and 10, with CI/CD pipelines that auto-build community-submitted manifests representing the highest-value target.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
dnsmasq's DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option when the server processes a single DHCPv6 packet from an attacker on the same local link. The over-read byte is neither returned to the client nor logged, and no crash or confirmed information disclosure has been demonstrated; the independent assessment scores confidentiality, integrity, and availability impact as none, so real-world risk is low despite the genuine memory-safety defect. No CISA KEV entry or public exploit code was identified at time of analysis.
DHCP lease metadata disclosure in dnsmasq (CVE-2026-93010) occurs when the DHCP leasequery feature has been switched on without an allow-list of permitted query sources, letting any host on the local network pull lease records - assigned IP addresses, MAC addresses, hostnames and related lease metadata. The package is shipped across Red Hat Enterprise Linux 6 through 10 and is bundled into Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform builds, but the vulnerable feature is off unless an administrator explicitly enables it. Severity is capped at a confidentiality-only leak (CVSS 4.3, adjacent-network attack vector), and no public exploit code or active exploitation has been identified at time of analysis.
TFTP file substitution in dnsmasq allows an attacker on the local network to make a later client receive stale, previously cached transfer data instead of the file it requested; in PXE network-boot deployments this can substitute attacker-chosen boot content for a victim machine, giving both confidentiality and integrity impact. The flaw only exists when dnsmasq is running with its TFTP server feature enabled (a non-default configuration used for network boot), requires adjacent-network access (AV:A) with no authentication (PR:N) and no user interaction (UI:N), but is rated high complexity (AC:H) because the attacker cannot control when another client will request the same file and pick up the cached response. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the vendor-reported CVSS 3.1 score is 6.8, making this a moderate, situational issue rather than an emergency; Red Hat tracks it for remediation within the current monthly cycle.
Denial of service against dnsmasq's TCP DNS service: remote attackers can occupy the entire small fixed pool of TCP child processes by holding idle connections open to port 53, which blocks new TCP DNS queries and any DNSSEC validation that depends on TCP fallback. The flaw is packaged in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform 13 (Queens) and 18.0, so any of those deployments exposing TCP/53 to untrusted networks is in scope. Impact is confined to availability and is time-bounded rather than permanent - UDP resolution keeps working and occupied slots are released after a fixed lifetime - and no public exploit identified at time of analysis.
dnsmasq builds that include the DNSSEC validator and have validation enabled at runtime can write a few bytes past an internal domain-name buffer when converting names to and from DNS wire format, corrupting adjacent heap metadata. Only deployments where DNSSEC support was compiled in and DNSSEC validation is switched on are exposed; the default dnsmasq build omits DNSSEC entirely, and exploitation further requires an attacker to make the resolver validate a crafted DNSSEC response, for example through a spoofed or attacker-controlled answer for a signed name. Rated CVSS 5.3 (integrity-only, low impact) and no public exploit identified at time of analysis; the priority signal is this_month, not immediate action.
A DNS cache-poisoning flaw in dnsmasq (CWE-345, insufficient verification of data authenticity) lets a malicious or compromised upstream resolver inject cached records for names outside its authoritative zone when dnsmasq follows a CNAME in a response. Only split-DNS deployments that forward specific domains to a designated upstream are realistically exposed, since the attacker must already occupy that trusted upstream position; standard single-forwarder or root-hint setups are far less affected. Impact is integrity-only (attacker-chosen addresses returned to later clients), rated CVSS 6.8 with AC:H, and no public exploit code or KEV entry was identified at time of analysis, so priority follows the vendor's this-month cadence rather than emergency response.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
gssproxy can be persistently crashed by any local user who can reach its Unix domain socket: a GSSX_INIT_SEC_CONTEXT request that omits the target_name field triggers a NULL pointer dereference in the daemon. The issue affects gssproxy deployments on Red Hat Enterprise Linux 7, 8, 9, and 10 and is listed for Red Hat OpenShift Container Platform 4; because gssproxy does not automatically restart, Kerberized NFS and IdM services that depend on it can be disrupted until an administrator intervenes. No public exploit identified at time of analysis.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
libslirp user-mode networking can disclose the host's real IP address to a guest when an ICMP echo request is handled through the fallback path and the reply length is not updated to match the actual data received. The flaw affects libslirp as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat OpenShift Container Platform 4, with exposure limited to guests using slirp-style user-mode networking rather than bridged or tap networking. Rated CVSS 3.5 with a monitor priority, exploitation requires a guest-level user able to send ICMP echo requests plus a host-side condition the attacker does not control, and no public exploit has been identified at time of analysis.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
An out-of-bounds read in libmodulemd's modulemd v2 rpm-map YAML serialization path can crash applications that process crafted module metadata, producing a local denial of service. The bug is triggered only when the metadata declares multiple digest algorithm types and is serialized through the affected path; default single-digest metadata does not trigger it. The assessed impact is availability-only, with no confirmed code execution or data exposure, and no public exploit code or CISA KEV entry was identified at time of analysis.
Stack exhaustion in libmodulemd's xmd (extended metadata) parser lets anyone who can place crafted modulemd YAML in front of a consuming process crash it or exhaust its resources, an availability-only denial of service (CVSS 6.2, C:N/I:N/A:H). The defect is in the recursive YAML mapping/sequence helpers that convert xmd content into nested GVariant values with no recursion-depth or node-count ceiling, so deeply nested input overflows the stack. Affected builds ship in Red Hat Enterprise Linux 8, 9 and 10, Red Hat Hardened Images, and OpenShift Container Platform 4; the vector AV:L/PR:N/UI:N means the attacker must first get the malicious metadata onto a host that parses it (for example an attacker-controlled or third-party module repository consumed by DNF/libdnf), after which no authentication or user interaction is required. No public exploit code and no confirmed active exploitation were identified in the available intelligence at time of analysis.
Denial of service in libmodulemd can be triggered when a build compiled with rpmio support parses a highly compressible modulemd YAML file; the custom decompression read handler does not cap cumulative decompressed output before parsing, allowing CPU and memory exhaustion that can hang or crash the consuming process. The issue is scored CVSS 6.2 with a LOCAL vector, requires no authentication or user interaction once a malicious file reaches the parser, and is associated by CPE data with Red Hat Enterprise Linux 8, 9, and 10 plus related OpenShift and hardened image products. No public exploit code or CISA KEV-listed active exploitation was identified in the supplied intelligence.
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
Local credential disclosure in cockpit-machines, the Cockpit web module for managing libvirt/KVM virtual machines on Red Hat Enterprise Linux 9 and 10, exposes a guest VM's VNC console password to other unprivileged users on the same host. When an operator saves VNC console settings, the configured password is handed to an underlying system utility as a command-line argument, so any local user able to inspect another user's process entries can read the secret during that brief window. Exploitation requires an already-authenticated local account (PR:L), a host without hidepid-style process hiding, and a concurrent victim save action (UI:R); no public exploit code exists and the flaw is not in CISA KEV.
Information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 lets a local unprivileged user capture RHSM authentication tokens from the command line of a short-lived image-retrieval helper process when cross-user process inspection is enabled. The attacker needs a local shell account and a concurrent image-retrieval operation by another user; stolen tokens can be used against RHSM resources only until they expire. This is a moderate-risk, low-urgency issue with no public exploit identified at time of analysis, and it does not provide remote access, code execution, or integrity/availability impact.
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the GStreamer ASF demuxer (gst-plugins-ugly), rated CVSS 6.5, allows a crafted ASF, WMV, or WMA file to drive an oversized heap allocation because an attacker-controlled Simple Index entry count is not bounded by the object's actual payload. The issue affects gst-plugins-ugly packages in Red Hat Enterprise Linux 7, 8, 9, and 10; exploitation requires a victim to open or preview the malicious media file, with an unauthenticated network vector and user interaction required, and impact is limited to availability loss with no code execution or data exposure. No public exploit identified at time of analysis.
Local privilege escalation in Red Hat rhc's rhc-canonical-facts.service lets an attacker who has already compromised the privileged yggdrasil service account pre-plant a symbolic link so the root-run unit follows it and changes ownership of an arbitrary file, enabling escalation to root. The flaw is CWE-59 link following and affects rhc installations on Red Hat Enterprise Linux 7, 8, 9, and 10 per CPE data; exploitation is local-only and requires high privileges (CVSS PR:H), so risk is confined to systems where the yggdrasil account is already reachable. No public exploit code was identified in the provided sources at time of analysis, and no CISA KEV or EPSS signal was supplied.
Repeated state-notification requests sent to a network-reachable rpc.statd service in nfs-utils cause memory allocated during callback processing to never be released, producing continuous memory growth that can degrade or crash the service and exhaust host resources. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but exploitation is not trivial: a single request is insufficient because the attacker must sustain a stream of requests long enough to exhaust memory, which is why the vector carries AC:H and the impact is availability-only (C:N/I:N/A:H, base score 5.9). Exposure is limited in practice because rpc.statd only runs when NFSv3 locking services are active and is normally bound to internal or trusted networks rather than the public internet, so firewalled or default deployments are not reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; this is a genuine but moderate-priority availability issue rather than a top-tier emergency, and affected services can be recovered by a restart.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Denial of service in libtirpc allows an authenticated remote RPC client to exhaust server memory by sending oversized wrapped-data requests to an RPC service that is configured with RPCSEC_GSS integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection. Only services explicitly running in that non-default, Kerberos-backed mode are exposed - most commonly NFS deployments on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - and the impact is availability-only (CVSS 6.5, A:H) with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it warrants medium-priority patch tracking rather than emergency response, although affected RPC services can become unstable or terminate under the resource exhaustion.
Local denial of service in the nfs-utils fsidd daemon affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4; an authenticated local user with access to the fsidd Unix domain socket can send a malformed request that omits required arguments, triggering a CWE-617 assertion failure and crashing the daemon. The service remains unavailable for filesystem identifier lookups until restarted, giving this a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis.
Argument injection in libblockdev's NTFS and VFAT label-setting routines lets a local, unprivileged user smuggle command-line flags into the ntfslabel and fatlabel utilities through a filesystem label that begins with a dash. The vulnerable paths (bd_fs_ntfs_set_label() and bd_fs_vfat_set_label()) are reachable without administrator authentication via the udisks2 Filesystem.SetLabel() D-Bus method, but exploitation is strictly local and the assessed impact is low integrity only - no confidentiality or availability loss and no privilege escalation. No public exploit code has been identified at time of analysis, and the low CVSS score (3.3, AV:L/PR:L/I:L) reflects the limited blast radius rather than an unexplored attack surface.
Improper boundary validation of metadata slot values in luksmeta allows an attacker who can supply or modify a LUKS disk header to redirect wipe or load operations outside the intended metadata area, overwriting or zeroing encrypted payload data and causing persistent data loss and corrupted storage. The attack is confined to a local vector and requires high privileges - root-level write access to the raw block device, or inducing an administrator to process an attacker-supplied untrusted disk image whose header carries out-of-range slot values together with valid checksums. The impact is limited to integrity and availability, with no information disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the moderate CVSS of 6.0 reflects the substantial privilege barrier rather than the severity of the data-loss outcome.
An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
Host-side denial of service and potential memory corruption in DPDK's lib/vhost arise because memory-region sizes are not adequately validated before mmap during vhost memory-region setup (CWE-770). The affected code ships to customers through Red Hat Fast Datapath for RHEL 8, 9 and 10, and therefore reaches Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift Container Platform 4 and Red Hat OpenStack Platform 13 (Queens) deployments that use DPDK vhost-user acceleration. An attacker who controls a connected vhost-user frontend - typically a guest VM or a process holding the vhost-user socket - can crash the host (CVSS 6.5, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation.
A time-of-check/time-of-use race in the DPDK vhost library's handling of virtio indirect descriptor tables allows an attacker who already controls a guest VM attached to a DPDK vhost-user backend to crash or disrupt the host vhost process by mutating the descriptor table length between the host's two reads from guest memory, or by supplying an out-of-range next index against a small host-side copy in the vDPA relay path. Exploitation requires local/guest-level low privilege (PR:L) and is heavily timing-dependent (AC:H), and the impact is confined to availability - the out-of-bounds bytes are consumed internally as descriptor fields for GPA translation and are never returned to the guest as payload, so no confidentiality or integrity loss is assessed. This is a moderate, defense-in-depth-class residual of the CVE-2018-1059 fix rather than an urgent priority, and no public exploit code was identified at time of analysis.
Local authenticated attackers can retrieve LUKS disk-encryption passphrases from hosts using the Clevis PKCS#11 pin because the clevis-pkcs11-afunix-socket-unlock daemon writes passphrases in plaintext to a world-readable log file. This affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4 deployments where this non-default disk-unlock configuration is in use. No public exploit code has been identified at time of analysis; exploitation requires an existing low-privileged local account and prior logging of a LUKS unlock passphrase.
An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.
Local attackers can exploit improperly secured AF_UNIX sockets in the clevis PKCS#11 pin to inject arbitrary device/key pairs or intercept LUKS passphrases, potentially gaining unauthorized access to encrypted disks. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. Exploitation requires an authenticated local user and a permissive process umask; no public exploit code or active exploitation has been identified, and the issue is rated modest priority due to the local-only attack vector and dependency on non-default umask settings.
Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.
A stack-based out-of-bounds write in GNOME Remote Desktop's VNC TLS read path, as shipped in Red Hat Enterprise Linux 8, 9, and 10, can crash the service and cause denial of service. An unauthenticated remote attacker (per the CVSS vector PR:N) who can reach an enabled VNC TLS listener and drive the connection into a peek/read size mismatch can corrupt memory on the stack; the vector rates this CVSS 5.9 with availability-only impact (C:N/I:N/A:H) and high attack complexity (AC:H), reflecting that the mismatch is non-trivial to trigger reliably. The vulnerable configuration is not default: remote desktop sharing must be explicitly enabled with the VNC backend and a reachable TLS listener, which is uncommon on headless or server RHEL installs; no public exploit code and no confirmed active exploitation were identified at time of analysis, and this should be handled as a routine patch rather than an emergency.
Crafted ISO-2022 encoded text passed to the m17n-lib decoder can trigger an uninitialized stack memory read, potentially leaking small amounts of process memory if the application then returns or displays the decoded output to the attacker. The issue is rated low severity (CVSS 2.5, AV:L/AC:H/UI:R, unauthenticated per vector PR:N) and affects multilanguage library builds shipped across Red Hat Enterprise Linux 6 through 10, though any application embedding m17n-lib's ISO-2022 handling is in scope. No public exploit identified at time of analysis; risk is gated by the fact that the deploying application must both decode attacker-supplied ISO-2022 input and reflect the decoded result back, which is uncommon in typical installations.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
Data corruption in luksmeta allows a local attacker who already holds administrative privileges to damage or destroy metadata and encrypted payload data stored on a Linux Unified Key Setup (LUKS) device when a new metadata entry is saved. Because faulty free-space boundary calculations and flawed overlap detection can let new records be written past the available area or on top of existing ones, integrity is fully compromised though confidentiality is not (CVSS 5.1, AV:L/AC:L/PR:H/UI:N/C:N/I:H/A:L), and affected volumes may become inaccessible. Exploitation requires local host access with privileges sufficient to run luksmeta and write to the device; there is no remote or unauthenticated vector, no public exploit identified at time of analysis, and no confirmed active exploitation (not in CISA KEV), so impact is realistically limited to accidental or deliberate corruption by a privileged operator. The issue affects luksmeta as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10, plus Red Hat OpenShift Container Platform 4 through the underlying RHCOS userland.
Information disclosure in flatpak-builder lets a crafted build manifest read sensitive host files and embed their contents into resulting build artifacts, because source download definitions that specify local file:// URIs bypass the tool's directory confinement checks. Exploitation requires a developer or CI system to actually process the untrusted manifest (user interaction per CVSS UI:R), so it is not remotely triggerable without someone initiating a build; no public exploit identified at time of analysis. Red Hat rates it moderate at CVSS 6.1, and the affected package ships in Red Hat Enterprise Linux 8, 9, and 10, with CI/CD pipelines that auto-build community-submitted manifests representing the highest-value target.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.