Red Hat Enterprise Linux 10
Monthly
Denial of service in open-iscsi's iscsiuio daemon allows an unauthenticated attacker on the same local network segment to render the daemon permanently unresponsive by sending a single crafted ICMPv6 Router Advertisement carrying a zero-length option, triggering an infinite loop and sustained CPU exhaustion. Affected deployments include Red Hat Enterprise Linux 9 and 10 systems where iscsiuio is active for iSCSI hardware offload. A secondary out-of-bounds read risk exists when a short IPv6 payload is processed, though no memory corruption or data exposure has been confirmed from available intelligence; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer underflow in GStreamer's avidemux element allows a remote unauthenticated attacker to trigger heap out-of-bounds read and write, heap memory disclosure, and application crash by delivering a crafted AVI file containing a malformed FUJIFILM strd chunk. The gst_avi_demux_parse_strd() function decrements its remaining-length counter by fixed offsets without bounds checking, causing unsigned integer wraparound for payloads of exactly 106 or 107 bytes. Because avidemux is auto-plugged by GStreamer's high-level components (playbin, decodebin, gst-discoverer), any application that opens or previews a media file - including GNOME Files, Nautilus, Totem, and many others - can trigger the vulnerability without user awareness. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available in gst-plugins-good 1.28.6.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included unredacted in diagnostic archives uploaded to console.redhat.com. The redaction layer uses a naive string-match on the literal key name 'password', leaving non-standard credential field names - such as those used by SSSD and Pacemaker - completely unprotected before archive upload. With CVSS PR:L, a threat actor with authenticated access to an organization's Red Hat Insights console can retrieve these cleartext credentials from stored archives. No public exploit identified at time of analysis and not confirmed in CISA KEV.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Directory Server 11-13) allows unauthenticated remote attackers - when the default anonymous access setting is active - to manipulate replication metadata, purge changelog records, and abort administrator-initiated cleanup tasks. The affected operations are replication-maintenance primitives that bypass the authorization layer entirely (CWE-862), meaning no account or session is required under default configuration. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the network-accessible, zero-authentication attack surface in a widely deployed enterprise directory server makes this a notable availability and integrity risk.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Persistent denial of service in libkcapi's AIO interface allows a local attacker to permanently hang an affected application thread by exploiting improper error-state handling in _kcapi_aio_read_all(). Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - all environments where applications leverage libkcapi's asynchronous cryptographic operations. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) and local-only attack vector substantially limit real-world risk beyond targeted or insider-threat scenarios.
IV reuse in libkcapi's one-shot symmetric cipher operations allows a remote attacker to weaken data confidentiality for applications processing inputs larger than 64 KiB under stateful modes (CTR or CBC). Affected deployments include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified; the AV:N vector reflects an indirect attack path where an adversary induces a vulnerable application to process specially crafted oversized inputs, enabling ciphertext analysis to expose plaintext relationships or recover data.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SSRF bypass in stunnel 5.79 and earlier allows authenticated SOCKS proxy clients to circumvent intended localhost access restrictions by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) in proxy requests. Exploitation reaches loopback-bound services on the stunnel host - services deliberately isolated from external network access - potentially exposing internal APIs, administrative interfaces, or other localhost-only endpoints. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
GNU tar's --one-top-level extraction mode fails to confine hardlink targets to the designated top-level directory, allowing a crafted archive to plant hardlinks that escape the intended extraction boundary. When combined with a preexisting symbolic link already present under the working directory, an attacker who can induce a victim to extract a malicious archive may read or write files outside the intended extraction scope on systems running affected RHEL versions (6 through 10) and Red Hat Hardened Images. No public exploit has been identified at time of analysis, and exploitation requires both user interaction and a specific environmental pre-condition, keeping real-world risk moderate despite GNU tar's ubiquitous deployment.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 3.1 score of 6.2 reflects real-world risk limited by the high privilege prerequisite and required operator interaction.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Denial of service in dbus-broker allows a local attacker to crash the user session bus broker when file descriptor limits are exhausted. Affected products include Red Hat Enterprise Linux 9/10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images where dbus-broker is deployed. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.11%).
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
PKCE bypass in librest allows OAuth 2.0 client impersonation by exploiting a cryptographically weak pseudo-random number generator. The library's code verifier generation for PKCE (RFC 7636) uses GLib's GRand function - a non-cryptographic PRNG with a 32-bit seed space - rather than a CSPRNG, enabling a positioned attacker to recover the PRNG seed and reconstruct the code verifier to hijack the token exchange. Rated CVSS 6.8 with high confidentiality and integrity impact; no public exploit or CISA KEV listing identified at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.4 reflects low confidentiality impact constrained by the circumstantial trigger condition.
Unbounded memory growth in libssh's SFTP client allows a malicious server to exhaust client-side memory by sending responses for unknown request IDs, resulting in a denial-of-service condition against any application using libssh for SFTP operations. Affected deployments include libssh as packaged in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images. No public exploit code and no active exploitation have been identified at time of analysis; the CVSS score of 5.3 (Medium) reflects the limited availability impact and the requirement that a victim client connect to an attacker-controlled server.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Memory exhaustion in libssh's SFTP server subsystem allows authenticated remote clients to degrade or crash the service by sending SSH_FXP_READ requests specifying an arbitrarily large read length, causing the server to allocate unbounded memory for each request. The CVSS vector (PR:L) confirms exploitation requires valid credentials, limiting the attack surface to authenticated SFTP users. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low complexity and network-accessible attack path make this a realistic insider or credential-abuse scenario.
Signal misdelivery in libssh's ProxyCommand handling allows a low-privileged local user to trigger a local denial of service affecting their entire accessible process tree. When fork() fails during ProxyCommand execution, the error return value of -1 is stored unchecked as a child process ID; at cleanup, libssh signals PID -1, which Linux interprets as a broadcast to all processes the caller has permission to signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the CVSS scope-changed metric (S:C) confirms that impact extends beyond the libssh component itself to co-located user processes.
CPU exhaustion via malformed SSH channel negotiation in libssh allows an authenticated remote peer to cause indefinite server-side looping and denial of service. By advertising a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, the attacker forces subsequent channel writes into an infinite loop, fully consuming CPU on the affected host. This affects libssh as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.
ACL bypass in kronosnet (versions ≤ 1.34) allows remote unauthenticated attackers to inject arbitrary data packets into cluster communication channels under a specific dual-condition deployment configuration. By spoofing a valid link ID in crafted network frames, an attacker circumvents the ACL subsystem entirely, potentially causing data corruption or service instabilities in clustering stacks shipped with Red Hat Enterprise Linux 8, 9, 10 and OpenShift Container Platform 4. No public exploit code and no active exploitation have been identified at time of analysis.
Stack-based buffer overflow in the rpcinfo client utility (part of the rpcbind package) crashes the client process when querying a malicious or compromised rpcbind server using the `-l` flag. Address data returned by the server is copied into a fixed-size stack buffer without bounds validation (CWE-121), enabling a server-side attacker to trigger a denial of service against any administrator or script that runs `rpcinfo -l` against their controlled endpoint. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to client-side availability with no confidentiality or integrity exposure.
Out-of-bounds memory corruption in kronosnet's packet reassembly engine (versions ≤ 1.34) enables a remote, unauthenticated network attacker to crash the kronosnet process or cause heap corruption by transmitting malformed fragmented packets carrying invalid sequence numbers. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, and Red Hat OpenShift Container Platform 4, making this relevant to HA clustering infrastructure that depends on kronosnet for inter-node communication via Corosync or Pacemaker. No public exploit code and no active exploitation have been identified at time of analysis, though the network-accessible, no-privilege-required attack path elevates operational risk for clustered environments despite the AC:H complexity rating.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Heap buffer over-read in libsoup's HTTP/2 GOAWAY frame parser allows remote unauthenticated attackers to crash applications or leak heap memory fragments by sending a malformed frame with a non-NUL-terminated Additional Debug Data payload. Affected deployments include applications built on libsoup running on Red Hat Enterprise Linux 10 that accept or initiate HTTP/2 connections. A proof-of-concept exists per SSVC data, though exploitation is rated non-automatable and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in libsoup 3.6.6 exposes WebSocket clients to memory disclosure and crashes when connecting to malicious servers. The incomplete fix for CVE-2026-0716 (commit 6ff7ef0) placed the integer overflow guard exclusively inside the masked-frame branch, leaving the unmasked server-to-client frame path entirely unprotected - allowing a crafted payload length near UINT64_MAX to bypass the guard entirely. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS AC:H rating reflects the non-trivial preconditions: a specific client configuration and attacker-controlled server are both required.
Timing side-channel exposure in Red Hat Directory Server's PBKDF2-SHA256 password verification allows a remote unauthenticated attacker to send repeated LDAP bind requests and statistically infer partial hash information by measuring response-time differences caused by non-constant-time memcmp() comparisons. Affected deployments span Red Hat Directory Server 11 through 13 and the 389-ds-base package shipped across RHEL 6 through 10. No public exploit identified at time of analysis, and practical exploitation is acknowledged to be extremely difficult due to the computational overhead inherent in PBKDF2 key stretching, which substantially degrades the timing signal.
Attribute encryption in the 389-ds-base LDBM backend exposes a cryptographic design flaw affecting Red Hat Directory Server 11, 12, and 13 across all supported RHEL releases (6 through 10). The LDBM backend applies a static, hardcoded initialization vector (IV) for both AES-CBC and 3DES-CBC encryption of directory attribute values, meaning that two entries storing identical plaintext for an encrypted attribute will always produce identical ciphertext blocks - a classic ciphertext equality oracle. An attacker with privileged filesystem-level read access to the LDBM database files can exploit this to determine whether any two encrypted attribute values are identical, leaking relational information about the directory without recovering plaintext. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to corrupt heap memory and likely crash the LDAP service. The flaw triggers when the server processes an LDAP operation - such as a search request - whose base DN contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), causing an out-of-bounds write during RDN attribute-value pair sorting. Per the confirmed CVSS vector (PR:N), no authentication is required; no public exploit code or CISA KEV listing has been identified at time of analysis.
Two off-by-one errors in FreeIPA's ipa-otpd daemon expose RHEL 6 through 10 deployments configured with an external OAuth2/OIDC Identity Provider to out-of-bounds memory access during the device authorization flow. An attacker who controls or can man-in-the-middle the configured IdP endpoint can serve an oversized authorization response, triggering CWE-787 writes or reads one byte past a fixed-size buffer boundary. The most probable outcome is denial of service of the ipa-otpd daemon; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stack exhaustion via multiple unbounded alloca() calls in the PulseAudio protocol server on Red Hat Enterprise Linux 8, 9, and 10 allows a local low-privileged attacker to crash the audio daemon, resulting in denial of service. The root cause (CWE-770) is the absence of size validation on attacker-controlled protocol parameters before passing them to alloca(), a stack-based allocator with no OS-enforced ceiling. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Denial-of-service via NULL pointer dereference in PipeWire's RAOP (Remote Audio Output Protocol) module affects Red Hat Enterprise Linux 8, 9, and 10. The RAOP module fails to enforce an upper bound on Content-Length values in incoming requests and does not validate the return value of pw_array_add(); when a sufficiently large Content-Length triggers an allocation failure, the unchecked NULL return causes a crash of the PipeWire daemon, resulting in complete loss of audio services. No special authentication is required from the adjacent network, and no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in dhcpcd's IPv6 Neighbor Discovery Router Advertisement parser allows an adjacent unauthenticated attacker to exhaust CPU resources on any host running dhcpcd with IPv6 enabled. The flaw (CWE-835 - infinite loop) arises because a zero-length Neighbor Discovery option passes initial storage validation but is later reparsed without sufficient bounds enforcement, causing the parser to loop indefinitely without advancing. No active exploitation is confirmed (not in CISA KEV), but the adjacent-network attack vector and zero-privilege requirement make this actionable on shared Layer-2 environments such as enterprise Wi-Fi, cloud VLANs, and data-center segments.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Stack exhaustion in p11-kit's RPC server crashes the daemon and any dependent cryptographic services on affected Red Hat systems. The vulnerability exists in the PKCS#11 RPC message parsing layer, where two attribute-handling functions form a mutually-recursive call chain with no depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes - allowing any local user or process with socket access to crash the server by sending a single crafted request. No public exploit or active exploitation has been identified at time of analysis, and impact is limited to availability (denial of service) with no confidentiality or integrity consequence.
Heap use-after-free read in libblkid (util-linux) enables unauthenticated local attackers to crash udisks or leak root-process heap data by presenting a crafted block device image during nested partition probing. BSD, Minix, Solaris x86, and UnixWare partition table parsers cache raw pointers into a dynamically allocated partition array; when subsequent partition additions trigger array reallocation, those pointers become stale and dereference freed memory. Because udev and udisks invoke libblkid automatically as root on block-device hot-plug events, USB insertion alone is sufficient to trigger the flaw without any user interaction or authentication. No public exploit identified at time of analysis.
Path traversal in spice-vdagent enables a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system during file transfer operations. Affecting Red Hat Enterprise Linux versions 6 through 10, the flaw stems from unsanitized filenames supplied by the SPICE host before use by the vdagent process, allowing writes at the privilege level of the logged-in guest user. No public exploit is identified at time of analysis, and exploitation requires prior control of the SPICE host - a high-privilege precondition that substantially constrains realistic risk despite the high integrity impact.
Integer overflow in spice-vdagent's message parsing allows a malicious or compromised SPICE host to crash the guest VM's vdagent daemon by delivering a specially crafted message that triggers a downstream heap buffer overflow. Affected deployments span spice-vdagent as packaged in Red Hat Enterprise Linux 6 through 10, where the daemon runs inside guests handling host-to-guest SPICE protocol communications. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is structurally constrained by the requirement that the attacking SPICE host itself be untrusted or already compromised prior to the attack.
Heap out-of-bounds read in GStreamer's gst-plugins-bad H.264 parser allows an attacker to crash a media application or leak a single byte of heap memory by tricking a victim into opening a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units. Affected systems span Red Hat Enterprise Linux versions 6 through 10 where gst-plugins-bad is installed. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the narrow 1-byte read, required user interaction, and local attack vector substantially limit real-world exploitation impact.
Out-of-bounds read in the GStreamer gst-plugins-bad H.266/VVC parser allows a remote attacker to leak up to 8 bytes of application memory by delivering a crafted video file with a manipulated aspect ratio indicator value. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10 wherever gst-plugins-bad processes H.266/VVC content. No public exploit code or active exploitation has been identified at time of analysis; the limited read window and user-interaction requirement constrain practical impact, but the network-reachable vector and zero-authentication requirement lower the delivery barrier.
Credential exposure in the Ansible nexmo module (plugins/modules/nexmo.py) causes Vonage/Nexmo API keys and secrets to appear in plaintext within HTTP GET request URLs, bypassing the no_log=True protection entirely. The module affects Red Hat Enterprise Linux 8, 9, and 10 deployments, and credentials are captured passively in Ansible verbose output, network proxy logs, SIEM traffic inspection, AWX/Automation Controller debug logs, and Vonage server-side access logs. No public exploit identified at time of analysis, though exploitation requires only read access to any of these log sources.
Credential exposure in the Ansible keyring_info module (plugins/modules/keyring_info.py) causes master passwords, SSH key passphrases, and service credentials retrieved from OS-native keystores to be emitted as plaintext in task output, registered variables, and persistent log backends. Any local user with access to Ansible playbook output - including AWX/Tower job logs, Redis or JSON fact caches, and debug task output - can read credentials in full. A proof-of-concept demonstrating plaintext passphrase capture from Ansible output exists, though no confirmed active exploitation (CISA KEV) has been observed. Affected deployments span RHEL 8, 9, and 10 per Red Hat CPE data.
Heap out-of-bounds read in dnsmasq's find_soa() function allows a remote attacker controlling a DNS zone to leak up to 10 bytes of stale heap memory by serving a crafted NXDOMAIN response. The flaw exists because extract_name() is invoked with extrabytes=0 when parsing NS section records, skipping the mandatory boundary check for the 10-byte fixed-length DNS record trailer fields. Confirmed affected platforms include Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4; no public exploit or CISA KEV listing has been identified at time of analysis.
OpenSSH's GSSAPI authentication cleanup routine contains a heap out-of-bounds read (CWE-125) triggered when the auth-indicators array lacks a trailing NULL terminator, allowing a remote unauthenticated attacker to crash the SSH authentication path and deny SSH service availability. Exploitation is constrained by high attack complexity (AC:H) due to the non-default Kerberos/GSSAPI configuration requirement, limiting real-world exposure to a minority of deployments. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and the impact is restricted to partial availability loss with no confidentiality or integrity consequence.
X11 forwarding session hijacking in OpenSSH enables a local unprivileged attacker sharing a Linux client host to intercept and partially manipulate the victim's forwarded X11 display traffic by squatting on the predictable abstract UNIX domain socket name before the SSH client creates it. Affected deployments span OpenSSH packages across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, but successful exploitation yields high-confidence access to sensitive X11 session data including keystrokes, window contents, and clipboard material.
Client-side Denial of Service in OpenSSH's Diffie-Hellman Group Exchange implementation allows a malicious SSH server to crash connecting clients running in FIPS mode. When a victim initiates an SSH connection to an attacker-controlled server, the server sends crafted DH-GEX group parameters that trigger a double free (CWE-415) during FIPS known-group validation, terminating the client process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the constraint that only FIPS-mode clients are affected limits real-world impact to regulated or government environments.
Malformed HTTP Range request handling in libsoup (GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6-10) re-introduces a signed integer underflow originally patched in CVE-2026-2443. A rework commit replaced specific overflow guards with a general signed comparison, meaning a suffix-byte Range request whose length exceeds the resource content size now produces a negative start offset that is passed unclamped to buffer operations, generating malformed HTTP 206 responses and log flooding. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector makes any exposed libsoup HTTP server reachable without credentials.
Heap-based buffer overflow in dnsmasq's DNSSEC logging path enables remote denial of service against instances where both DNSSEC validation and query logging are simultaneously enabled. When dnsmasq receives a DS or DNSKEY DNS response containing an algorithm or digest type it does not recognize, its logging routine writes past the end of an internal heap-allocated buffer, corrupting memory and crashing the process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-deliverable attack vector (PR:N) makes the configuration prerequisite the primary limiting factor for defenders.
Use-after-free in 389 Directory Server's schema reload path crashes the server when administrative schema reloads race against active LDAP query worker threads. The `attr_syntax_swap_ht()` function bypasses the refcount-based deferred deletion mechanism used throughout the attribute syntax subsystem, directly freeing nodes that concurrent worker threads may still hold references to. Affected products span Red Hat Directory Server 11, 12, and 13 across RHEL 6 through 10; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.0 reflects the high-complexity, high-privilege prerequisites that substantially reduce real-world risk.
Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to the `aci` attribute to silently corrupt heap memory in the directory server process by submitting a malformed Access Control Instruction string. The `__aclp__normalize_acltxt()` function in `aclparse.c` performs pointer arithmetic on the keyword portion of an ACI string without validating minimum remaining buffer length after whitespace stripping, resulting in a 1-byte out-of-bounds write followed by out-of-bounds reads (CWE-787). No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available via GitHub PR #7542 but a released patched version has not been independently confirmed.
Arbitrary file deletion in evolution-data-server's addressbook file backend exposes host filesystem to manipulation by a Flatpak application with D-Bus access. The vulnerability exploits split validation logic: a crafted URI embedding directory traversal sequences (e.g., '../') is accepted without sufficient sanitization during contact creation or modification, but when the same URI is later processed at deletion time, a second, less restrictive check fails to catch the traversal - allowing files outside the intended addressbook directory to be removed. Critically, deletion of Flatpak override files could be leveraged to silently weaken sandbox restrictions for subsequent application runs. No public exploit has been identified at time of analysis.
Use-after-free memory corruption in GnuTLS's PKCS#11 PIN management function `gnutls_pkcs11_token_set_pin` enables a local low-privileged attacker to crash the process and potentially corrupt memory on systems where PKCS#11 tokens are deployed without a protected authentication path. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4, as confirmed by Red Hat (reporter) and covered under GnuTLS upstream advisory GNUTLS-SA-2026-04-29-9. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in GNOME localsearch's tracker-extract-mp3 component enables a local attacker to crash the metadata extraction daemon and potentially disclose heap memory contents by supplying a specially crafted MP3 file with malformed ID3v2.3 COMM tags. Affected platforms confirmed by Red Hat include RHEL 8, 9, and 10, where GNOME localsearch (formerly tracker-miners) runs as a background desktop search indexing service. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; exploitation is further constrained by the requirement for local access, low privileges, and user interaction.
Out-of-bounds read in the tracker-extract-mp3 component of GNOME localsearch (formerly tracker-miners) allows a low-privileged local user to trigger an application crash or leak sensitive process memory when the indexer parses a specially crafted MP3 file. Affected deployments include Red Hat Enterprise Linux 8, 9, and 10 running the GNOME desktop stack. No public exploit or active exploitation has been identified at time of analysis, though the file-based delivery mechanism - providing a malicious MP3 to a system where localsearch auto-indexes media - keeps realistic attacker reach higher than the AV:L vector alone implies.
Heap out-of-bounds read in GNOME localsearch (formerly tracker-miners) MP3 Extractor affects Red Hat Enterprise Linux 8, 9, and 10, exploitable when a local user triggers indexing of a specially crafted MP3 file containing malformed ID3v2.4 tags. The missing bounds check in the `extract_performers_tags` function can cause a Denial of Service via an unmapped memory read, and in certain heap layout scenarios may also leak fragments of heap memory, resulting in limited information disclosure. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in GStreamer's AV1 codec parser (gst-plugins-bad) allows a remote unauthenticated attacker to crash any application using GStreamer for AV1 media playback by delivering a specially crafted AV1 file. The root cause is a unit mismatch in the gst_av1_parser_parse_tile_list_obu() function, which feeds a byte count to an API expecting a bit count, desynchronizing the parser and triggering an assertion abort. No public exploit has been identified at time of analysis, and exploitation requires user interaction; however, the vulnerability affects Red Hat Enterprise Linux 6 through 10 where GStreamer is a core multimedia component.
Out-of-bounds read vulnerabilities in GStreamer's pcapparse element expose Red Hat Enterprise Linux 6 through 10 users to potential application crashes or limited memory disclosure when processing malformed PCAP files. The flaws reside in IPv4/TCP header parsing logic, where specially crafted PCAP records trigger reads beyond buffer boundaries across multiple code paths. Real-world exposure is materially constrained by pcapparse's restriction to debugging pipelines, the requirement for local user interaction, and high attack complexity; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The flaw exists because the virtio-blk device omits validation of input descriptor sizes prior to writing data, enabling a malicious guest operator to submit a crafted virtio-blk SCSI request that writes beyond the allocated host heap buffer. The primary confirmed impact is a denial of service (DoS) of the QEMU process on the host; no public exploit code has been identified at time of analysis and it is not listed in the CISA KEV catalog.
Stack buffer overflow in GStreamer's H.265/HEVC codec parser (gst-plugins-bad) allows remote unauthenticated attackers to crash GStreamer-based applications by delivering a crafted H.265 video file or stream that a user opens. The root cause is an incorrect loop bound in the buffering period SEI message parser: the parser mistakenly uses cpb_cnt_minus1[i] (the current loop index variable) rather than cpb_cnt_minus1[0] from the referenced Sequence Parameter Set, causing the loop to iterate beyond the bounds of stack-allocated CPB delay arrays and corrupt stack memory. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the deterministic parser logic makes crash reproduction straightforward.
Out-of-bounds write in GStreamer's H.266/VVC PPS picture partition parser (`gst-plugins-bad`) allows an attacker to crash media-processing applications - and potentially achieve code execution - by delivering a crafted H.266/VVC media file. The flaw in `gst_h266_parser_parse_picture_partition()` (gsth266parser.c) permits unbounded slice index increments across three fixed-size arrays in `GstH266PPS` during multi-slice-in-tile processing. A proof-of-concept demonstrating at least a 4-byte write exists; no public exploit beyond that initial POC or CISA KEV listing has been identified at time of analysis, though the code structure permits larger writes across multiple iterations which elevates downstream risk above a pure DoS assessment.
Denial of service in open-iscsi's iscsiuio daemon allows an unauthenticated attacker on the same local network segment to render the daemon permanently unresponsive by sending a single crafted ICMPv6 Router Advertisement carrying a zero-length option, triggering an infinite loop and sustained CPU exhaustion. Affected deployments include Red Hat Enterprise Linux 9 and 10 systems where iscsiuio is active for iSCSI hardware offload. A secondary out-of-bounds read risk exists when a short IPv6 payload is processed, though no memory corruption or data exposure has been confirmed from available intelligence; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer underflow in GStreamer's avidemux element allows a remote unauthenticated attacker to trigger heap out-of-bounds read and write, heap memory disclosure, and application crash by delivering a crafted AVI file containing a malformed FUJIFILM strd chunk. The gst_avi_demux_parse_strd() function decrements its remaining-length counter by fixed offsets without bounds checking, causing unsigned integer wraparound for payloads of exactly 106 or 107 bytes. Because avidemux is auto-plugged by GStreamer's high-level components (playbin, decodebin, gst-discoverer), any application that opens or previews a media file - including GNOME Files, Nautilus, Totem, and many others - can trigger the vulnerability without user awareness. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available in gst-plugins-good 1.28.6.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included unredacted in diagnostic archives uploaded to console.redhat.com. The redaction layer uses a naive string-match on the literal key name 'password', leaving non-standard credential field names - such as those used by SSSD and Pacemaker - completely unprotected before archive upload. With CVSS PR:L, a threat actor with authenticated access to an organization's Red Hat Insights console can retrieve these cleartext credentials from stored archives. No public exploit identified at time of analysis and not confirmed in CISA KEV.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Directory Server 11-13) allows unauthenticated remote attackers - when the default anonymous access setting is active - to manipulate replication metadata, purge changelog records, and abort administrator-initiated cleanup tasks. The affected operations are replication-maintenance primitives that bypass the authorization layer entirely (CWE-862), meaning no account or session is required under default configuration. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the network-accessible, zero-authentication attack surface in a widely deployed enterprise directory server makes this a notable availability and integrity risk.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Persistent denial of service in libkcapi's AIO interface allows a local attacker to permanently hang an affected application thread by exploiting improper error-state handling in _kcapi_aio_read_all(). Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - all environments where applications leverage libkcapi's asynchronous cryptographic operations. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) and local-only attack vector substantially limit real-world risk beyond targeted or insider-threat scenarios.
IV reuse in libkcapi's one-shot symmetric cipher operations allows a remote attacker to weaken data confidentiality for applications processing inputs larger than 64 KiB under stateful modes (CTR or CBC). Affected deployments include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified; the AV:N vector reflects an indirect attack path where an adversary induces a vulnerable application to process specially crafted oversized inputs, enabling ciphertext analysis to expose plaintext relationships or recover data.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SSRF bypass in stunnel 5.79 and earlier allows authenticated SOCKS proxy clients to circumvent intended localhost access restrictions by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) in proxy requests. Exploitation reaches loopback-bound services on the stunnel host - services deliberately isolated from external network access - potentially exposing internal APIs, administrative interfaces, or other localhost-only endpoints. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
GNU tar's --one-top-level extraction mode fails to confine hardlink targets to the designated top-level directory, allowing a crafted archive to plant hardlinks that escape the intended extraction boundary. When combined with a preexisting symbolic link already present under the working directory, an attacker who can induce a victim to extract a malicious archive may read or write files outside the intended extraction scope on systems running affected RHEL versions (6 through 10) and Red Hat Hardened Images. No public exploit has been identified at time of analysis, and exploitation requires both user interaction and a specific environmental pre-condition, keeping real-world risk moderate despite GNU tar's ubiquitous deployment.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 3.1 score of 6.2 reflects real-world risk limited by the high privilege prerequisite and required operator interaction.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Denial of service in dbus-broker allows a local attacker to crash the user session bus broker when file descriptor limits are exhausted. Affected products include Red Hat Enterprise Linux 9/10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images where dbus-broker is deployed. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.11%).
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
PKCE bypass in librest allows OAuth 2.0 client impersonation by exploiting a cryptographically weak pseudo-random number generator. The library's code verifier generation for PKCE (RFC 7636) uses GLib's GRand function - a non-cryptographic PRNG with a 32-bit seed space - rather than a CSPRNG, enabling a positioned attacker to recover the PRNG seed and reconstruct the code verifier to hijack the token exchange. Rated CVSS 6.8 with high confidentiality and integrity impact; no public exploit or CISA KEV listing identified at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.4 reflects low confidentiality impact constrained by the circumstantial trigger condition.
Unbounded memory growth in libssh's SFTP client allows a malicious server to exhaust client-side memory by sending responses for unknown request IDs, resulting in a denial-of-service condition against any application using libssh for SFTP operations. Affected deployments include libssh as packaged in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images. No public exploit code and no active exploitation have been identified at time of analysis; the CVSS score of 5.3 (Medium) reflects the limited availability impact and the requirement that a victim client connect to an attacker-controlled server.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Memory exhaustion in libssh's SFTP server subsystem allows authenticated remote clients to degrade or crash the service by sending SSH_FXP_READ requests specifying an arbitrarily large read length, causing the server to allocate unbounded memory for each request. The CVSS vector (PR:L) confirms exploitation requires valid credentials, limiting the attack surface to authenticated SFTP users. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low complexity and network-accessible attack path make this a realistic insider or credential-abuse scenario.
Signal misdelivery in libssh's ProxyCommand handling allows a low-privileged local user to trigger a local denial of service affecting their entire accessible process tree. When fork() fails during ProxyCommand execution, the error return value of -1 is stored unchecked as a child process ID; at cleanup, libssh signals PID -1, which Linux interprets as a broadcast to all processes the caller has permission to signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, but the CVSS scope-changed metric (S:C) confirms that impact extends beyond the libssh component itself to co-located user processes.
CPU exhaustion via malformed SSH channel negotiation in libssh allows an authenticated remote peer to cause indefinite server-side looping and denial of service. By advertising a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, the attacker forces subsequent channel writes into an infinite loop, fully consuming CPU on the affected host. This affects libssh as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.
ACL bypass in kronosnet (versions ≤ 1.34) allows remote unauthenticated attackers to inject arbitrary data packets into cluster communication channels under a specific dual-condition deployment configuration. By spoofing a valid link ID in crafted network frames, an attacker circumvents the ACL subsystem entirely, potentially causing data corruption or service instabilities in clustering stacks shipped with Red Hat Enterprise Linux 8, 9, 10 and OpenShift Container Platform 4. No public exploit code and no active exploitation have been identified at time of analysis.
Stack-based buffer overflow in the rpcinfo client utility (part of the rpcbind package) crashes the client process when querying a malicious or compromised rpcbind server using the `-l` flag. Address data returned by the server is copied into a fixed-size stack buffer without bounds validation (CWE-121), enabling a server-side attacker to trigger a denial of service against any administrator or script that runs `rpcinfo -l` against their controlled endpoint. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to client-side availability with no confidentiality or integrity exposure.
Out-of-bounds memory corruption in kronosnet's packet reassembly engine (versions ≤ 1.34) enables a remote, unauthenticated network attacker to crash the kronosnet process or cause heap corruption by transmitting malformed fragmented packets carrying invalid sequence numbers. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, and Red Hat OpenShift Container Platform 4, making this relevant to HA clustering infrastructure that depends on kronosnet for inter-node communication via Corosync or Pacemaker. No public exploit code and no active exploitation have been identified at time of analysis, though the network-accessible, no-privilege-required attack path elevates operational risk for clustered environments despite the AC:H complexity rating.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Heap buffer over-read in libsoup's HTTP/2 GOAWAY frame parser allows remote unauthenticated attackers to crash applications or leak heap memory fragments by sending a malformed frame with a non-NUL-terminated Additional Debug Data payload. Affected deployments include applications built on libsoup running on Red Hat Enterprise Linux 10 that accept or initiate HTTP/2 connections. A proof-of-concept exists per SSVC data, though exploitation is rated non-automatable and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in libsoup 3.6.6 exposes WebSocket clients to memory disclosure and crashes when connecting to malicious servers. The incomplete fix for CVE-2026-0716 (commit 6ff7ef0) placed the integer overflow guard exclusively inside the masked-frame branch, leaving the unmasked server-to-client frame path entirely unprotected - allowing a crafted payload length near UINT64_MAX to bypass the guard entirely. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS AC:H rating reflects the non-trivial preconditions: a specific client configuration and attacker-controlled server are both required.
Timing side-channel exposure in Red Hat Directory Server's PBKDF2-SHA256 password verification allows a remote unauthenticated attacker to send repeated LDAP bind requests and statistically infer partial hash information by measuring response-time differences caused by non-constant-time memcmp() comparisons. Affected deployments span Red Hat Directory Server 11 through 13 and the 389-ds-base package shipped across RHEL 6 through 10. No public exploit identified at time of analysis, and practical exploitation is acknowledged to be extremely difficult due to the computational overhead inherent in PBKDF2 key stretching, which substantially degrades the timing signal.
Attribute encryption in the 389-ds-base LDBM backend exposes a cryptographic design flaw affecting Red Hat Directory Server 11, 12, and 13 across all supported RHEL releases (6 through 10). The LDBM backend applies a static, hardcoded initialization vector (IV) for both AES-CBC and 3DES-CBC encryption of directory attribute values, meaning that two entries storing identical plaintext for an encrypted attribute will always produce identical ciphertext blocks - a classic ciphertext equality oracle. An attacker with privileged filesystem-level read access to the LDBM database files can exploit this to determine whether any two encrypted attribute values are identical, leaking relational information about the directory without recovering plaintext. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to corrupt heap memory and likely crash the LDAP service. The flaw triggers when the server processes an LDAP operation - such as a search request - whose base DN contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), causing an out-of-bounds write during RDN attribute-value pair sorting. Per the confirmed CVSS vector (PR:N), no authentication is required; no public exploit code or CISA KEV listing has been identified at time of analysis.
Two off-by-one errors in FreeIPA's ipa-otpd daemon expose RHEL 6 through 10 deployments configured with an external OAuth2/OIDC Identity Provider to out-of-bounds memory access during the device authorization flow. An attacker who controls or can man-in-the-middle the configured IdP endpoint can serve an oversized authorization response, triggering CWE-787 writes or reads one byte past a fixed-size buffer boundary. The most probable outcome is denial of service of the ipa-otpd daemon; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Stack exhaustion via multiple unbounded alloca() calls in the PulseAudio protocol server on Red Hat Enterprise Linux 8, 9, and 10 allows a local low-privileged attacker to crash the audio daemon, resulting in denial of service. The root cause (CWE-770) is the absence of size validation on attacker-controlled protocol parameters before passing them to alloca(), a stack-based allocator with no OS-enforced ceiling. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Denial-of-service via NULL pointer dereference in PipeWire's RAOP (Remote Audio Output Protocol) module affects Red Hat Enterprise Linux 8, 9, and 10. The RAOP module fails to enforce an upper bound on Content-Length values in incoming requests and does not validate the return value of pw_array_add(); when a sufficiently large Content-Length triggers an allocation failure, the unchecked NULL return causes a crash of the PipeWire daemon, resulting in complete loss of audio services. No special authentication is required from the adjacent network, and no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in dhcpcd's IPv6 Neighbor Discovery Router Advertisement parser allows an adjacent unauthenticated attacker to exhaust CPU resources on any host running dhcpcd with IPv6 enabled. The flaw (CWE-835 - infinite loop) arises because a zero-length Neighbor Discovery option passes initial storage validation but is later reparsed without sufficient bounds enforcement, causing the parser to loop indefinitely without advancing. No active exploitation is confirmed (not in CISA KEV), but the adjacent-network attack vector and zero-privilege requirement make this actionable on shared Layer-2 environments such as enterprise Wi-Fi, cloud VLANs, and data-center segments.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Stack exhaustion in p11-kit's RPC server crashes the daemon and any dependent cryptographic services on affected Red Hat systems. The vulnerability exists in the PKCS#11 RPC message parsing layer, where two attribute-handling functions form a mutually-recursive call chain with no depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes - allowing any local user or process with socket access to crash the server by sending a single crafted request. No public exploit or active exploitation has been identified at time of analysis, and impact is limited to availability (denial of service) with no confidentiality or integrity consequence.
Heap use-after-free read in libblkid (util-linux) enables unauthenticated local attackers to crash udisks or leak root-process heap data by presenting a crafted block device image during nested partition probing. BSD, Minix, Solaris x86, and UnixWare partition table parsers cache raw pointers into a dynamically allocated partition array; when subsequent partition additions trigger array reallocation, those pointers become stale and dereference freed memory. Because udev and udisks invoke libblkid automatically as root on block-device hot-plug events, USB insertion alone is sufficient to trigger the flaw without any user interaction or authentication. No public exploit identified at time of analysis.
Path traversal in spice-vdagent enables a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system during file transfer operations. Affecting Red Hat Enterprise Linux versions 6 through 10, the flaw stems from unsanitized filenames supplied by the SPICE host before use by the vdagent process, allowing writes at the privilege level of the logged-in guest user. No public exploit is identified at time of analysis, and exploitation requires prior control of the SPICE host - a high-privilege precondition that substantially constrains realistic risk despite the high integrity impact.
Integer overflow in spice-vdagent's message parsing allows a malicious or compromised SPICE host to crash the guest VM's vdagent daemon by delivering a specially crafted message that triggers a downstream heap buffer overflow. Affected deployments span spice-vdagent as packaged in Red Hat Enterprise Linux 6 through 10, where the daemon runs inside guests handling host-to-guest SPICE protocol communications. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is structurally constrained by the requirement that the attacking SPICE host itself be untrusted or already compromised prior to the attack.
Heap out-of-bounds read in GStreamer's gst-plugins-bad H.264 parser allows an attacker to crash a media application or leak a single byte of heap memory by tricking a victim into opening a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units. Affected systems span Red Hat Enterprise Linux versions 6 through 10 where gst-plugins-bad is installed. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the narrow 1-byte read, required user interaction, and local attack vector substantially limit real-world exploitation impact.
Out-of-bounds read in the GStreamer gst-plugins-bad H.266/VVC parser allows a remote attacker to leak up to 8 bytes of application memory by delivering a crafted video file with a manipulated aspect ratio indicator value. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10 wherever gst-plugins-bad processes H.266/VVC content. No public exploit code or active exploitation has been identified at time of analysis; the limited read window and user-interaction requirement constrain practical impact, but the network-reachable vector and zero-authentication requirement lower the delivery barrier.
Credential exposure in the Ansible nexmo module (plugins/modules/nexmo.py) causes Vonage/Nexmo API keys and secrets to appear in plaintext within HTTP GET request URLs, bypassing the no_log=True protection entirely. The module affects Red Hat Enterprise Linux 8, 9, and 10 deployments, and credentials are captured passively in Ansible verbose output, network proxy logs, SIEM traffic inspection, AWX/Automation Controller debug logs, and Vonage server-side access logs. No public exploit identified at time of analysis, though exploitation requires only read access to any of these log sources.
Credential exposure in the Ansible keyring_info module (plugins/modules/keyring_info.py) causes master passwords, SSH key passphrases, and service credentials retrieved from OS-native keystores to be emitted as plaintext in task output, registered variables, and persistent log backends. Any local user with access to Ansible playbook output - including AWX/Tower job logs, Redis or JSON fact caches, and debug task output - can read credentials in full. A proof-of-concept demonstrating plaintext passphrase capture from Ansible output exists, though no confirmed active exploitation (CISA KEV) has been observed. Affected deployments span RHEL 8, 9, and 10 per Red Hat CPE data.
Heap out-of-bounds read in dnsmasq's find_soa() function allows a remote attacker controlling a DNS zone to leak up to 10 bytes of stale heap memory by serving a crafted NXDOMAIN response. The flaw exists because extract_name() is invoked with extrabytes=0 when parsing NS section records, skipping the mandatory boundary check for the 10-byte fixed-length DNS record trailer fields. Confirmed affected platforms include Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4; no public exploit or CISA KEV listing has been identified at time of analysis.
OpenSSH's GSSAPI authentication cleanup routine contains a heap out-of-bounds read (CWE-125) triggered when the auth-indicators array lacks a trailing NULL terminator, allowing a remote unauthenticated attacker to crash the SSH authentication path and deny SSH service availability. Exploitation is constrained by high attack complexity (AC:H) due to the non-default Kerberos/GSSAPI configuration requirement, limiting real-world exposure to a minority of deployments. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and the impact is restricted to partial availability loss with no confidentiality or integrity consequence.
X11 forwarding session hijacking in OpenSSH enables a local unprivileged attacker sharing a Linux client host to intercept and partially manipulate the victim's forwarded X11 display traffic by squatting on the predictable abstract UNIX domain socket name before the SSH client creates it. Affected deployments span OpenSSH packages across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, but successful exploitation yields high-confidence access to sensitive X11 session data including keystrokes, window contents, and clipboard material.
Client-side Denial of Service in OpenSSH's Diffie-Hellman Group Exchange implementation allows a malicious SSH server to crash connecting clients running in FIPS mode. When a victim initiates an SSH connection to an attacker-controlled server, the server sends crafted DH-GEX group parameters that trigger a double free (CWE-415) during FIPS known-group validation, terminating the client process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the constraint that only FIPS-mode clients are affected limits real-world impact to regulated or government environments.
Malformed HTTP Range request handling in libsoup (GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6-10) re-introduces a signed integer underflow originally patched in CVE-2026-2443. A rework commit replaced specific overflow guards with a general signed comparison, meaning a suffix-byte Range request whose length exceeds the resource content size now produces a negative start offset that is passed unclamped to buffer operations, generating malformed HTTP 206 responses and log flooding. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector makes any exposed libsoup HTTP server reachable without credentials.
Heap-based buffer overflow in dnsmasq's DNSSEC logging path enables remote denial of service against instances where both DNSSEC validation and query logging are simultaneously enabled. When dnsmasq receives a DS or DNSKEY DNS response containing an algorithm or digest type it does not recognize, its logging routine writes past the end of an internal heap-allocated buffer, corrupting memory and crashing the process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-deliverable attack vector (PR:N) makes the configuration prerequisite the primary limiting factor for defenders.
Use-after-free in 389 Directory Server's schema reload path crashes the server when administrative schema reloads race against active LDAP query worker threads. The `attr_syntax_swap_ht()` function bypasses the refcount-based deferred deletion mechanism used throughout the attribute syntax subsystem, directly freeing nodes that concurrent worker threads may still hold references to. Affected products span Red Hat Directory Server 11, 12, and 13 across RHEL 6 through 10; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.0 reflects the high-complexity, high-privilege prerequisites that substantially reduce real-world risk.
Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to the `aci` attribute to silently corrupt heap memory in the directory server process by submitting a malformed Access Control Instruction string. The `__aclp__normalize_acltxt()` function in `aclparse.c` performs pointer arithmetic on the keyword portion of an ACI string without validating minimum remaining buffer length after whitespace stripping, resulting in a 1-byte out-of-bounds write followed by out-of-bounds reads (CWE-787). No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available via GitHub PR #7542 but a released patched version has not been independently confirmed.
Arbitrary file deletion in evolution-data-server's addressbook file backend exposes host filesystem to manipulation by a Flatpak application with D-Bus access. The vulnerability exploits split validation logic: a crafted URI embedding directory traversal sequences (e.g., '../') is accepted without sufficient sanitization during contact creation or modification, but when the same URI is later processed at deletion time, a second, less restrictive check fails to catch the traversal - allowing files outside the intended addressbook directory to be removed. Critically, deletion of Flatpak override files could be leveraged to silently weaken sandbox restrictions for subsequent application runs. No public exploit has been identified at time of analysis.
Use-after-free memory corruption in GnuTLS's PKCS#11 PIN management function `gnutls_pkcs11_token_set_pin` enables a local low-privileged attacker to crash the process and potentially corrupt memory on systems where PKCS#11 tokens are deployed without a protected authentication path. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4, as confirmed by Red Hat (reporter) and covered under GnuTLS upstream advisory GNUTLS-SA-2026-04-29-9. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in GNOME localsearch's tracker-extract-mp3 component enables a local attacker to crash the metadata extraction daemon and potentially disclose heap memory contents by supplying a specially crafted MP3 file with malformed ID3v2.3 COMM tags. Affected platforms confirmed by Red Hat include RHEL 8, 9, and 10, where GNOME localsearch (formerly tracker-miners) runs as a background desktop search indexing service. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; exploitation is further constrained by the requirement for local access, low privileges, and user interaction.
Out-of-bounds read in the tracker-extract-mp3 component of GNOME localsearch (formerly tracker-miners) allows a low-privileged local user to trigger an application crash or leak sensitive process memory when the indexer parses a specially crafted MP3 file. Affected deployments include Red Hat Enterprise Linux 8, 9, and 10 running the GNOME desktop stack. No public exploit or active exploitation has been identified at time of analysis, though the file-based delivery mechanism - providing a malicious MP3 to a system where localsearch auto-indexes media - keeps realistic attacker reach higher than the AV:L vector alone implies.
Heap out-of-bounds read in GNOME localsearch (formerly tracker-miners) MP3 Extractor affects Red Hat Enterprise Linux 8, 9, and 10, exploitable when a local user triggers indexing of a specially crafted MP3 file containing malformed ID3v2.4 tags. The missing bounds check in the `extract_performers_tags` function can cause a Denial of Service via an unmapped memory read, and in certain heap layout scenarios may also leak fragments of heap memory, resulting in limited information disclosure. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in GStreamer's AV1 codec parser (gst-plugins-bad) allows a remote unauthenticated attacker to crash any application using GStreamer for AV1 media playback by delivering a specially crafted AV1 file. The root cause is a unit mismatch in the gst_av1_parser_parse_tile_list_obu() function, which feeds a byte count to an API expecting a bit count, desynchronizing the parser and triggering an assertion abort. No public exploit has been identified at time of analysis, and exploitation requires user interaction; however, the vulnerability affects Red Hat Enterprise Linux 6 through 10 where GStreamer is a core multimedia component.
Out-of-bounds read vulnerabilities in GStreamer's pcapparse element expose Red Hat Enterprise Linux 6 through 10 users to potential application crashes or limited memory disclosure when processing malformed PCAP files. The flaws reside in IPv4/TCP header parsing logic, where specially crafted PCAP records trigger reads beyond buffer boundaries across multiple code paths. Real-world exposure is materially constrained by pcapparse's restriction to debugging pipelines, the requirement for local user interaction, and high attack complexity; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The flaw exists because the virtio-blk device omits validation of input descriptor sizes prior to writing data, enabling a malicious guest operator to submit a crafted virtio-blk SCSI request that writes beyond the allocated host heap buffer. The primary confirmed impact is a denial of service (DoS) of the QEMU process on the host; no public exploit code has been identified at time of analysis and it is not listed in the CISA KEV catalog.
Stack buffer overflow in GStreamer's H.265/HEVC codec parser (gst-plugins-bad) allows remote unauthenticated attackers to crash GStreamer-based applications by delivering a crafted H.265 video file or stream that a user opens. The root cause is an incorrect loop bound in the buffering period SEI message parser: the parser mistakenly uses cpb_cnt_minus1[i] (the current loop index variable) rather than cpb_cnt_minus1[0] from the referenced Sequence Parameter Set, causing the loop to iterate beyond the bounds of stack-allocated CPB delay arrays and corrupt stack memory. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the deterministic parser logic makes crash reproduction straightforward.
Out-of-bounds write in GStreamer's H.266/VVC PPS picture partition parser (`gst-plugins-bad`) allows an attacker to crash media-processing applications - and potentially achieve code execution - by delivering a crafted H.266/VVC media file. The flaw in `gst_h266_parser_parse_picture_partition()` (gsth266parser.c) permits unbounded slice index increments across three fixed-size arrays in `GstH266PPS` during multi-slice-in-tile processing. A proof-of-concept demonstrating at least a 4-byte write exists; no public exploit beyond that initial POC or CISA KEV listing has been identified at time of analysis, though the code structure permits larger writes across multiple iterations which elevates downstream risk above a pure DoS assessment.