Red Hat Enterprise Linux 6
Monthly
Stack-based buffer overflow in GIMP's PSD plug-in image-resource header loader lets a crafted PSD file crash GIMP and potentially execute arbitrary code with the privileges of the user opening the file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms local access and user interaction are required, with no privileges needed, so this is not remote unauthenticated exploitation. No public exploit identified at time of analysis; the 7.8 HIGH score reflects high confidentiality, integrity, and availability impact rather than ease of exploitation.
Unbounded memory growth in the glib-networking TLS 1.3 client-side session cache allows a malicious or compromised server to exhaust client memory by sending excessive session ticket messages, resulting in denial of service. The issue affects glib-networking as tracked in Red Hat Enterprise Linux 6 through 10 when a client negotiates TLS 1.3 and connects to an attacker-controlled or attacker-influenced endpoint. No public exploit code was identified at time of analysis; an upstream fix is available via glib-networking merge request 288, but a released patched version is not independently confirmed.
ARP/neighbor-table poisoning in the iscsiuio userspace daemon shipped with open-iscsi lets an unauthenticated attacker on the same Layer 2 segment redirect network traffic by sending a single minimal IPv6 Neighbor Advertisement. Affected deployments are those where iscsiuio is actually running for iSCSI hardware offload (typically with supported Broadcom NICs); a default server without iSCSI offload configured is not exposed. The same handler also reads link-layer address options at a fixed offset without confirming the packet carries them, an out-of-bounds read that can leak memory or crash the daemon; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in the iscsiuio DHCPv4 option parser, part of open-iscsi, allows an attacker on the same Layer-2 segment to send a crafted DHCP response that can crash the daemon, corrupt its network configuration, and potentially disclose limited heap data. Deployments at risk are those running iscsiuio for iSCSI offload, notably on Broadcom bnx2/cnic NICs, and using DHCP-driven iSCSI configuration; Red Hat tracks Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) was provided; the issue is rated moderate priority (this_week).
Ghostscript as shipped with Red Hat Enterprise Linux 8-and, per CPE data, RHEL 6, 7, 9, and 10-may allow an attacker to escape -dSAFER protections when it processes a crafted PostScript file, enabling file access outside permitted paths or command execution with the Ghostscript process's privileges. The root cause is that Red Hat's 9.25-to-9.27 rebase omitted the CVE-2019-14869 correction, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected; the supplied CVSS base score is 7.3, while the independent assessment treats confidentiality and integrity impact as High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No CISA KEV entry is present in the supplied data and no public exploit identified at time of analysis; practical risk is conditional on a service or pipeline actually processing untrusted PostScript/EPS with an affected RHEL build.
Use-after-free in GIMP's XCF loader can crash the application and potentially allow arbitrary code execution when a user opens a crafted .xcf file that selects a path and then fails to load it. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 according to the provided CPE mappings, and exploitation is local and requires user interaction (CVSS 7.8, AV:L/UI:R/PR:N); no public exploit was identified at time of analysis. Because scope is unchanged, any code execution would run with the privileges of the user opening the file rather than automatically gaining root.
Opening a crafted XCF file in GIMP can trigger a use-after-free in the XCF loader's linked-channels handling, crashing the main GIMP process and potentially enabling code execution in the opening user's context. The defect affects GIMP installations that parse XCF files, with Red Hat tracking impact across RHEL 6 through RHEL 10 packages; exploitation requires local delivery and a victim to open the malicious image, and no public exploit code or CISA KEV entry is identified in the provided data.
Heap out-of-bounds read and write in GIMP's PSD thumbnail resource loader allows memory corruption when a victim opens or thumbnail-previews a crafted PSD file containing a grayscale JPEG thumbnail, potentially leading to code execution in the plug-in process. The loader assumes a 3-byte BGR stride and never validates that the embedded thumbnail is RGB, so a single-channel grayscale image drives out-of-bounds indexing. Rated CVSS 7.8 (AV:L/UI:R/PR:N) - a client-side file-parsing bug with no network reachability; no public exploit code identified at time of analysis, and Red Hat tracks it across RHEL 6 through 10.
Heap out-of-bounds read in GIMP's XCF text-layer parasite parsing allows a crafted .xcf file, opened by a victim, to leak adjacent heap memory into layer text and crash the application, causing information disclosure and denial of service. The issue is local and requires user interaction (CVSS 7.1, AV:L/UI:R/PR:N), and the provided intelligence shows no public exploit or CISA KEV entry; it is a moderate-priority issue rather than an urgent remote threat.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Local privilege escalation in cifs-utils lets an unprivileged local user obtain root on affected hosts by injecting unauthorized options into a privileged CIFS mount. When a root-owned service mounts a Common Internet File System share using a credentials file whose contents the attacker can control or influence - for example a file that is world-writable or lives in an attacker-owned path - cifs-utils assembles those unsanitized values into the mount option string, so the attacker can slip in extra options that bypass permission checks and cause files to be executed with administrative privileges. The flaw is tracked as CWE-88 (argument/option injection) with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing low-privilege local account (authenticated, per PR:L) and a deployment where such a privileged, credentials-file-driven CIFS mount workflow exists, so internet-facing hosts that do not mount attacker-influenced CIFS shares are not at risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and Red Hat has published advisory and Bugzilla tracking pages for RHEL 6 through 10 and OpenShift Container Platform 4.
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
Cyrus SASL clients that use the DIGEST-MD5 authentication mechanism can be crashed by a malicious or on-path server that supplies a crafted challenge field (such as realm or nonce), because the add_to_challenge() function computes a buffer size before DIGEST-MD5 quoting and fails to account for escaping that lengthens the value, resulting in a heap-based out-of-bounds write. This is a client-side denial-of-service flaw affecting Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H, meaning unauthenticated remote attackers must control or intercept the server endpoint and the victim must initiate authentication. No public exploit code or confirmed active exploitation is identified at time of analysis.
Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript or EPS document, chaining memory corruption in document parsing with a runtime bypass of the -dSAFER sandbox. The flaw affects Ghostscript as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no privileges are required but a victim or automated pipeline must render the malicious file, with the malicious document first reaching the processing system. Publicly available exploit code exists, including a GitHub proof-of-concept, but the provided data does not confirm CISA KEV active exploitation, so -dSAFER should not be treated as a protective mitigation for affected versions.
Dogtag PKI (pki-core) and its commercial counterpart, Red Hat Certificate System 9/10/11, contain a fail-open authentication flaw in the CMCAuthForEST plugin that lets an authenticated, low-privileged EST enrollment user obtain CA-signed certificates bearing arbitrary subject names. The bug is triggered when an EST fullcmc enrollment request is sent over BasicAuth without an end-user TLS client certificate; the SSL_CLIENT_CERT session attribute then retains the EST subsystem's agent certificate, so downstream authorization logic wrongly grants agent-level privileges. Exploitation is assessed as requiring only a valid EST user account (CVSS 8.1, PR:L, unauthenticated by client certificate, no user interaction), making it a realistic privilege-escalation path for any provisioned EST user or insider; however, no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV).
StartTLS handling in 389-ds-base does not discard plaintext bytes buffered before the TLS upgrade, allowing an on-path attacker to inject a crafted LDAP message whose messageID collides with a client's pending bind and causes the client to treat a failed authentication as successful. Red Hat Directory Server 11, 12, and 13 and Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments using 389-ds-base with StartTLS are affected. Exploitation requires an on-path network position and timing control during StartTLS negotiation, so the real-world bar is higher than the reported 9.0 base score; no public exploit identified at time of analysis.
Denial of service in 389-ds-base (the LDAP engine shipped with Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) lets an unauthenticated remote attacker stall the server's worker-thread pool by sending a complete LDAP operation followed by the opening bytes of an incomplete LDAPMessage on the same connection. The server then hands the connection to a second worker thread before the first worker's result is flushed; the second worker blocks on the connection mutex until nsslapd-ioblocktimeout, so the finished operation's response is never delivered. Repeating this over a handful of connections proportional to the configured worker-thread count exhausts the entire pool under default configuration, denying LDAP service to anonymous and authenticated clients over both plaintext and TLS for as long as the attacker holds the connections; no public exploit code has been identified at time of analysis, and no EPSS or KEV signal accompanies the CVE, though the availability-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is genuine for any internet- or broad-network-reachable directory server.
Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound message is compressed, truncated size calculations used to grow a GByteArray wrap, allowing zlib to write beyond the allocated buffer. The affected code is the outbound compression routine reached through the permessage-deflate extension (RFC 7692), so exploitation requires that the extension be negotiated on the WebSocket connection and that the endpoint emit a message large enough to cross the integer-truncation boundary - a precondition that materially narrows exploitation below the raw 9.8 base score. The CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, but no public exploit code has been identified and there is no confirmation of active exploitation (SSVC exploitation: none, no CISA KEV entry); EPSS is low at 0.30% (20th percentile), and Red Hat has published errata (RHSA-2026:83384, RHSA-2026:83618) addressing the flaw.
Heap memory corruption in libsoup can be triggered when a WebSocket client using libsoup constructs a masked outgoing frame for an extremely large payload near the 32-bit guint limit, truncating the GByteArray allocation size while the masking routine processes the full length. It affects libsoup as shipped in Red Hat Enterprise Linux 6 through 10. The assessed CVSS vector is network-reachable but high-complexity (AV:N/AC:H/PR:N/UI:N), and no public exploit identified at time of analysis.
Heap out-of-bounds read in libsoup's WebSocket implementation allows a remote, unauthenticated peer to trigger a heap buffer overflow when the application has configured max-incoming-payload-size to unlimited (0), a non-default setting; with the standard payload cap the overflow cannot be reached. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), but our assessed vector raises complexity to AC:H because exploitation requires both the non-default unlimited setting and a frame large enough to wrap the GByteArray length counter, implying a very large transfer. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read and application crash in libsoup's soup_uri_decode_data_uri() affect applications that pass attacker-controlled base64 data: URIs to the GLib-based HTTP library, with Red Hat shipping vulnerable packages across Red Hat Enterprise Linux 6, 7, 8, 9 and 10. A crafted data URI whose percent-decoded payload contains embedded NUL bytes causes the decoded length to remain uninitialized and be used as the size of the returned GBytes, yielding a minor confidentiality leak (C:L) alongside a serious availability impact (A:H) rated 8.2 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The issue is remotely triggerable without authentication (PR:N) and no public exploit code has been identified at time of analysis, though real-world exposure is limited to software that actually processes untrusted data: URIs (WebKit/GTK browsers, feed and mail readers, and other GNOME applications rendering remote content).
Heap corruption and denial of service in libsoup stem from unbounded WebSocket message reassembly: the code accumulates fragmented frames in a GByteArray without checking the total reassembled size against the buffer type's size limit, so an oversized message can truncate the tracked length while the implementation continues to use the full length, producing out-of-bounds memory access (CWE-125) and possible crashes. The flaw is reachable by unauthenticated remote peers that can establish a WebSocket connection with a libsoup-based server, or by a libsoup client that connects to an attacker-controlled or man-in-the-middle server, but the assessed vector (AC:H) reflects that the attacker must drive reassembly to the underlying ~4 GB buffer-type boundary, so ordinary small-message WebSocket traffic does not trigger it. No public exploit code or CISA KEV active-exploitation confirmation was identified at time of analysis.
A type-confusion memory-safety flaw in libsoup's WebSocket handling can crash or corrupt the heap of applications that process incoming Pong frames. When a Pong frame arrives, SoupWebsocketConnection emits its ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes object, so any application that connects a ::pong handler written to the documented GBytes API will misinterpret the payload and may suffer heap corruption or a crash. This is not exploitable against default libsoup usage: the target must both act as a WebSocket peer and explicitly register a ::pong handler, and the attacker must control or compromise the WebSocket endpoint (or otherwise inject a crafted Pong frame) into that connection. The recorded CVSS 3.1 base score is 8.6, but the independent assessment rates it AC:H with C:L/I:L/A:H because exploitation is gated on that non-default handler registration; unauthenticated remote attackers (PR:N, UI:N) can reach the code path, however no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited.
Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape the shared directory boundary and read or write arbitrary files on the host, potentially achieving code execution as the QEMU process user (VM escape). Only hosts that have enabled 9pfs/virtfs host-directory sharing are exposed, since this is not a default configuration; the attacker must be a local guest user able to issue 9p protocol requests and must win a race between QEMU's main thread and a 9pfs worker thread with concurrent Tlcreate and Twalk requests. No public exploit code or active exploitation telemetry was identified at time of analysis, but the flaw is rated high severity (CVSS 8.8, scope-changed, C:H/I:H/A:H) and affects QEMU packages shipped in Red Hat Enterprise Linux 6 through 10, Red Hat OpenShift Container Platform 4, and related Red Hat products.
Command injection in rpm enables an attacker to run arbitrary shell commands as the invoking user when a victim installs, rebuilds, or otherwise processes a malicious source RPM (.src.rpm) that contains a %() macro construct in a source or spec file basename. The flaw is local and requires user interaction, with impact confined to the privileges of the user running rpm or rpmbuild, typically non-root; build farms and CI/CD pipelines that automatically handle untrusted SRPMs are the highest-risk targets. Red Hat CPEs list RHEL 6 through 10 and Red Hat Hardened Images, and no public exploit was identified in the provided intelligence; monitor the vendor advisory for exploitation and patch updates.
Local attackers can achieve arbitrary code execution by tricking a user or automation into processing a crafted manifest file with 'rpm -q -p', due to unexpected macro expansion of manifest entries in RPM before they are opened. This command injection flaw (CWE-78) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction but no privileges, and impact is limited to the privileges of the rpm process. No public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds write in GIMP's GIMPressionist plug-in allows an attacker to corrupt memory by convincing a user to load a malicious preset file, potentially leading to a crash or arbitrary code execution. The flaw is an unauthenticated local attack (CVSS PR:N) that requires user interaction (UI:R) to open a crafted preset file, and it affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 plus likely upstream GIMP versions. No public exploit has been identified at time of analysis, and the overall risk is assessed as genuine but not urgent due to the requirement for user interaction with a crafted file.
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity declarations allows unauthenticated local attackers to crash or potentially execute code in applications that use the library. Tracked as CVE-2026-96889 and reported by Red Hat, the flaw affects librsvg as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. Exploitation requires user interaction (UI:R) because a victim must open, preview, or thumbnail a malicious SVG; the CVSS 3.1 score is 7.8. No public exploit code was identified at time of analysis, and independent assessment indicates that arbitrary code execution is unproven-only denial of service or crash is reliably reachable.
Code execution in GNU Emacs versions prior to 31.2 occurs when Flymake performs on-the-fly syntax checking with a language backend other than Emacs Lisp, allowing code embedded in an untrusted file to run with the privileges of the user who opened or edited it. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is local and requires the victim to open a malicious file, but needs no privileges and can fully compromise confidentiality, integrity, and availability of that user's session; the flaw is tracked by Red Hat as CVE-2026-96442 with a vendor score of 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is concentrated in developer and administration workstations where Emacs commonly opens untrusted source files from downloads, mail attachments, or repositories.
Unbounded memory growth in rpcbind allows remote, unauthenticated attackers to degrade or exhaust service availability by flooding the daemon with unique RPC requests that it records in statistics lists which are never pruned. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact, and affects rpcbind as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4. No public exploit code was identified at time of analysis, and exposure is limited to hosts on which the rpcbind service (typically TCP/UDP port 111) is network-reachable, because the attack requires no authentication, no user interaction and no non-default configuration.
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. Exploitation requires valid agent-level credentials and the default ACL configuration, and no public exploit code has been identified at time of analysis, so this is a privilege escalation inside an existing trusted role rather than unauthenticated access.
Privileged users inside a QEMU guest running on the Q35 machine type with the KVM accelerator can abuse the VAPIC setup hypercall (hw/i386/vapic.c) to break SMM isolation, because the code fails to verify that a writable RAM alias stays inside the option ROM window. By repositioning that alias over chipset-locked SMRAM, an attacker with root-equivalent guest access defeats D_LCK protection and injects code into System Management Mode memory, which QEMU scores as a scope-changing, total-impact compromise (CVSS 8.2). Exploitation is local to the guest with high privileges required (AV:L, PR:H, S:C), publicly available exploit code exists according to the CISA SSVC assessment, but there is no confirmed active exploitation and EPSS is low at 0.20% (10th percentile).
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Shell command injection in the Cockpit 389 Console allows an LDAP user with delegated entry-creation privileges to achieve root code execution on the directory server host. The 389-ds-base package, as deployed in Red Hat Directory Server 11/12/13 and RHEL 6-10, constructs ldapsearch commands by embedding LDAP distinguished names directly into shell strings without escaping metacharacters. An attacker controlling LDAP write access can plant a malicious DN; when a Cockpit administrator views that entry, injected shell commands execute with root privileges. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated integrity compromise in 389 Directory Server (shipped as Red Hat Directory Server 11/12/13 and bundled in RHEL 6-10) allows anonymous LDAP clients to bypass SELFDN-based access control checks. The SELFDN ACI bind-rule evaluator incorrectly equates an anonymous client's empty bind DN with an empty stored attribute value in a target directory entry, satisfying an ACI that was intended to permit only a matching authenticated identity. Exploitation enables anonymous directory modifications - including adding or altering entries - that SELFDN ACIs were designed to restrict to specific authenticated users. No public exploit has been identified at time of analysis.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Command injection in rpmuncompress allows a local attacker to execute arbitrary commands under the invoking user's context by supplying an archive file whose filename contains shell metacharacters. Affecting all actively supported Red Hat Enterprise Linux versions (6 through 10) and Red Hat Hardened Images, the flaw is triggered when a user or automated build pipeline invokes rpmuncompress on a maliciously named archive. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and broad RHEL enterprise deployment footprint make this a meaningful risk for organizations processing untrusted archives in development or CI/CD workflows.
Command injection in rpm's `rpmbuild -t*` subcommand allows arbitrary command execution with build-user privileges when an attacker controls the path or filename of a tarball being processed. The vulnerability arises because shell metacharacters in tarball names are not sanitized before being passed to a shell invocation inside rpmbuild. Exploitation is most realistic in automated CI/CD pipelines that fetch externally supplied artifact archives and pass them directly to rpmbuild, a common pattern in open-source package maintainer workflows. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.
Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.
Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Stack-based buffer overflow in GIMP's PSD plug-in image-resource header loader lets a crafted PSD file crash GIMP and potentially execute arbitrary code with the privileges of the user opening the file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms local access and user interaction are required, with no privileges needed, so this is not remote unauthenticated exploitation. No public exploit identified at time of analysis; the 7.8 HIGH score reflects high confidentiality, integrity, and availability impact rather than ease of exploitation.
Unbounded memory growth in the glib-networking TLS 1.3 client-side session cache allows a malicious or compromised server to exhaust client memory by sending excessive session ticket messages, resulting in denial of service. The issue affects glib-networking as tracked in Red Hat Enterprise Linux 6 through 10 when a client negotiates TLS 1.3 and connects to an attacker-controlled or attacker-influenced endpoint. No public exploit code was identified at time of analysis; an upstream fix is available via glib-networking merge request 288, but a released patched version is not independently confirmed.
ARP/neighbor-table poisoning in the iscsiuio userspace daemon shipped with open-iscsi lets an unauthenticated attacker on the same Layer 2 segment redirect network traffic by sending a single minimal IPv6 Neighbor Advertisement. Affected deployments are those where iscsiuio is actually running for iSCSI hardware offload (typically with supported Broadcom NICs); a default server without iSCSI offload configured is not exposed. The same handler also reads link-layer address options at a fixed offset without confirming the packet carries them, an out-of-bounds read that can leak memory or crash the daemon; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in the iscsiuio DHCPv4 option parser, part of open-iscsi, allows an attacker on the same Layer-2 segment to send a crafted DHCP response that can crash the daemon, corrupt its network configuration, and potentially disclose limited heap data. Deployments at risk are those running iscsiuio for iSCSI offload, notably on Broadcom bnx2/cnic NICs, and using DHCP-driven iSCSI configuration; Red Hat tracks Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) was provided; the issue is rated moderate priority (this_week).
Ghostscript as shipped with Red Hat Enterprise Linux 8-and, per CPE data, RHEL 6, 7, 9, and 10-may allow an attacker to escape -dSAFER protections when it processes a crafted PostScript file, enabling file access outside permitted paths or command execution with the Ghostscript process's privileges. The root cause is that Red Hat's 9.25-to-9.27 rebase omitted the CVE-2019-14869 correction, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected; the supplied CVSS base score is 7.3, while the independent assessment treats confidentiality and integrity impact as High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No CISA KEV entry is present in the supplied data and no public exploit identified at time of analysis; practical risk is conditional on a service or pipeline actually processing untrusted PostScript/EPS with an affected RHEL build.
Use-after-free in GIMP's XCF loader can crash the application and potentially allow arbitrary code execution when a user opens a crafted .xcf file that selects a path and then fails to load it. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 according to the provided CPE mappings, and exploitation is local and requires user interaction (CVSS 7.8, AV:L/UI:R/PR:N); no public exploit was identified at time of analysis. Because scope is unchanged, any code execution would run with the privileges of the user opening the file rather than automatically gaining root.
Opening a crafted XCF file in GIMP can trigger a use-after-free in the XCF loader's linked-channels handling, crashing the main GIMP process and potentially enabling code execution in the opening user's context. The defect affects GIMP installations that parse XCF files, with Red Hat tracking impact across RHEL 6 through RHEL 10 packages; exploitation requires local delivery and a victim to open the malicious image, and no public exploit code or CISA KEV entry is identified in the provided data.
Heap out-of-bounds read and write in GIMP's PSD thumbnail resource loader allows memory corruption when a victim opens or thumbnail-previews a crafted PSD file containing a grayscale JPEG thumbnail, potentially leading to code execution in the plug-in process. The loader assumes a 3-byte BGR stride and never validates that the embedded thumbnail is RGB, so a single-channel grayscale image drives out-of-bounds indexing. Rated CVSS 7.8 (AV:L/UI:R/PR:N) - a client-side file-parsing bug with no network reachability; no public exploit code identified at time of analysis, and Red Hat tracks it across RHEL 6 through 10.
Heap out-of-bounds read in GIMP's XCF text-layer parasite parsing allows a crafted .xcf file, opened by a victim, to leak adjacent heap memory into layer text and crash the application, causing information disclosure and denial of service. The issue is local and requires user interaction (CVSS 7.1, AV:L/UI:R/PR:N), and the provided intelligence shows no public exploit or CISA KEV entry; it is a moderate-priority issue rather than an urgent remote threat.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Local privilege escalation in cifs-utils lets an unprivileged local user obtain root on affected hosts by injecting unauthorized options into a privileged CIFS mount. When a root-owned service mounts a Common Internet File System share using a credentials file whose contents the attacker can control or influence - for example a file that is world-writable or lives in an attacker-owned path - cifs-utils assembles those unsanitized values into the mount option string, so the attacker can slip in extra options that bypass permission checks and cause files to be executed with administrative privileges. The flaw is tracked as CWE-88 (argument/option injection) with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing low-privilege local account (authenticated, per PR:L) and a deployment where such a privileged, credentials-file-driven CIFS mount workflow exists, so internet-facing hosts that do not mount attacker-influenced CIFS shares are not at risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and Red Hat has published advisory and Bugzilla tracking pages for RHEL 6 through 10 and OpenShift Container Platform 4.
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
Cyrus SASL clients that use the DIGEST-MD5 authentication mechanism can be crashed by a malicious or on-path server that supplies a crafted challenge field (such as realm or nonce), because the add_to_challenge() function computes a buffer size before DIGEST-MD5 quoting and fails to account for escaping that lengthens the value, resulting in a heap-based out-of-bounds write. This is a client-side denial-of-service flaw affecting Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H, meaning unauthenticated remote attackers must control or intercept the server endpoint and the victim must initiate authentication. No public exploit code or confirmed active exploitation is identified at time of analysis.
Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript or EPS document, chaining memory corruption in document parsing with a runtime bypass of the -dSAFER sandbox. The flaw affects Ghostscript as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no privileges are required but a victim or automated pipeline must render the malicious file, with the malicious document first reaching the processing system. Publicly available exploit code exists, including a GitHub proof-of-concept, but the provided data does not confirm CISA KEV active exploitation, so -dSAFER should not be treated as a protective mitigation for affected versions.
Dogtag PKI (pki-core) and its commercial counterpart, Red Hat Certificate System 9/10/11, contain a fail-open authentication flaw in the CMCAuthForEST plugin that lets an authenticated, low-privileged EST enrollment user obtain CA-signed certificates bearing arbitrary subject names. The bug is triggered when an EST fullcmc enrollment request is sent over BasicAuth without an end-user TLS client certificate; the SSL_CLIENT_CERT session attribute then retains the EST subsystem's agent certificate, so downstream authorization logic wrongly grants agent-level privileges. Exploitation is assessed as requiring only a valid EST user account (CVSS 8.1, PR:L, unauthenticated by client certificate, no user interaction), making it a realistic privilege-escalation path for any provisioned EST user or insider; however, no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV).
StartTLS handling in 389-ds-base does not discard plaintext bytes buffered before the TLS upgrade, allowing an on-path attacker to inject a crafted LDAP message whose messageID collides with a client's pending bind and causes the client to treat a failed authentication as successful. Red Hat Directory Server 11, 12, and 13 and Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments using 389-ds-base with StartTLS are affected. Exploitation requires an on-path network position and timing control during StartTLS negotiation, so the real-world bar is higher than the reported 9.0 base score; no public exploit identified at time of analysis.
Denial of service in 389-ds-base (the LDAP engine shipped with Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) lets an unauthenticated remote attacker stall the server's worker-thread pool by sending a complete LDAP operation followed by the opening bytes of an incomplete LDAPMessage on the same connection. The server then hands the connection to a second worker thread before the first worker's result is flushed; the second worker blocks on the connection mutex until nsslapd-ioblocktimeout, so the finished operation's response is never delivered. Repeating this over a handful of connections proportional to the configured worker-thread count exhausts the entire pool under default configuration, denying LDAP service to anonymous and authenticated clients over both plaintext and TLS for as long as the attacker holds the connections; no public exploit code has been identified at time of analysis, and no EPSS or KEV signal accompanies the CVE, though the availability-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is genuine for any internet- or broad-network-reachable directory server.
Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound message is compressed, truncated size calculations used to grow a GByteArray wrap, allowing zlib to write beyond the allocated buffer. The affected code is the outbound compression routine reached through the permessage-deflate extension (RFC 7692), so exploitation requires that the extension be negotiated on the WebSocket connection and that the endpoint emit a message large enough to cross the integer-truncation boundary - a precondition that materially narrows exploitation below the raw 9.8 base score. The CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, but no public exploit code has been identified and there is no confirmation of active exploitation (SSVC exploitation: none, no CISA KEV entry); EPSS is low at 0.30% (20th percentile), and Red Hat has published errata (RHSA-2026:83384, RHSA-2026:83618) addressing the flaw.
Heap memory corruption in libsoup can be triggered when a WebSocket client using libsoup constructs a masked outgoing frame for an extremely large payload near the 32-bit guint limit, truncating the GByteArray allocation size while the masking routine processes the full length. It affects libsoup as shipped in Red Hat Enterprise Linux 6 through 10. The assessed CVSS vector is network-reachable but high-complexity (AV:N/AC:H/PR:N/UI:N), and no public exploit identified at time of analysis.
Heap out-of-bounds read in libsoup's WebSocket implementation allows a remote, unauthenticated peer to trigger a heap buffer overflow when the application has configured max-incoming-payload-size to unlimited (0), a non-default setting; with the standard payload cap the overflow cannot be reached. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), but our assessed vector raises complexity to AC:H because exploitation requires both the non-default unlimited setting and a frame large enough to wrap the GByteArray length counter, implying a very large transfer. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read and application crash in libsoup's soup_uri_decode_data_uri() affect applications that pass attacker-controlled base64 data: URIs to the GLib-based HTTP library, with Red Hat shipping vulnerable packages across Red Hat Enterprise Linux 6, 7, 8, 9 and 10. A crafted data URI whose percent-decoded payload contains embedded NUL bytes causes the decoded length to remain uninitialized and be used as the size of the returned GBytes, yielding a minor confidentiality leak (C:L) alongside a serious availability impact (A:H) rated 8.2 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The issue is remotely triggerable without authentication (PR:N) and no public exploit code has been identified at time of analysis, though real-world exposure is limited to software that actually processes untrusted data: URIs (WebKit/GTK browsers, feed and mail readers, and other GNOME applications rendering remote content).
Heap corruption and denial of service in libsoup stem from unbounded WebSocket message reassembly: the code accumulates fragmented frames in a GByteArray without checking the total reassembled size against the buffer type's size limit, so an oversized message can truncate the tracked length while the implementation continues to use the full length, producing out-of-bounds memory access (CWE-125) and possible crashes. The flaw is reachable by unauthenticated remote peers that can establish a WebSocket connection with a libsoup-based server, or by a libsoup client that connects to an attacker-controlled or man-in-the-middle server, but the assessed vector (AC:H) reflects that the attacker must drive reassembly to the underlying ~4 GB buffer-type boundary, so ordinary small-message WebSocket traffic does not trigger it. No public exploit code or CISA KEV active-exploitation confirmation was identified at time of analysis.
A type-confusion memory-safety flaw in libsoup's WebSocket handling can crash or corrupt the heap of applications that process incoming Pong frames. When a Pong frame arrives, SoupWebsocketConnection emits its ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes object, so any application that connects a ::pong handler written to the documented GBytes API will misinterpret the payload and may suffer heap corruption or a crash. This is not exploitable against default libsoup usage: the target must both act as a WebSocket peer and explicitly register a ::pong handler, and the attacker must control or compromise the WebSocket endpoint (or otherwise inject a crafted Pong frame) into that connection. The recorded CVSS 3.1 base score is 8.6, but the independent assessment rates it AC:H with C:L/I:L/A:H because exploitation is gated on that non-default handler registration; unauthenticated remote attackers (PR:N, UI:N) can reach the code path, however no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited.
Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape the shared directory boundary and read or write arbitrary files on the host, potentially achieving code execution as the QEMU process user (VM escape). Only hosts that have enabled 9pfs/virtfs host-directory sharing are exposed, since this is not a default configuration; the attacker must be a local guest user able to issue 9p protocol requests and must win a race between QEMU's main thread and a 9pfs worker thread with concurrent Tlcreate and Twalk requests. No public exploit code or active exploitation telemetry was identified at time of analysis, but the flaw is rated high severity (CVSS 8.8, scope-changed, C:H/I:H/A:H) and affects QEMU packages shipped in Red Hat Enterprise Linux 6 through 10, Red Hat OpenShift Container Platform 4, and related Red Hat products.
Command injection in rpm enables an attacker to run arbitrary shell commands as the invoking user when a victim installs, rebuilds, or otherwise processes a malicious source RPM (.src.rpm) that contains a %() macro construct in a source or spec file basename. The flaw is local and requires user interaction, with impact confined to the privileges of the user running rpm or rpmbuild, typically non-root; build farms and CI/CD pipelines that automatically handle untrusted SRPMs are the highest-risk targets. Red Hat CPEs list RHEL 6 through 10 and Red Hat Hardened Images, and no public exploit was identified in the provided intelligence; monitor the vendor advisory for exploitation and patch updates.
Local attackers can achieve arbitrary code execution by tricking a user or automation into processing a crafted manifest file with 'rpm -q -p', due to unexpected macro expansion of manifest entries in RPM before they are opened. This command injection flaw (CWE-78) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction but no privileges, and impact is limited to the privileges of the rpm process. No public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds write in GIMP's GIMPressionist plug-in allows an attacker to corrupt memory by convincing a user to load a malicious preset file, potentially leading to a crash or arbitrary code execution. The flaw is an unauthenticated local attack (CVSS PR:N) that requires user interaction (UI:R) to open a crafted preset file, and it affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 plus likely upstream GIMP versions. No public exploit has been identified at time of analysis, and the overall risk is assessed as genuine but not urgent due to the requirement for user interaction with a crafted file.
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity declarations allows unauthenticated local attackers to crash or potentially execute code in applications that use the library. Tracked as CVE-2026-96889 and reported by Red Hat, the flaw affects librsvg as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. Exploitation requires user interaction (UI:R) because a victim must open, preview, or thumbnail a malicious SVG; the CVSS 3.1 score is 7.8. No public exploit code was identified at time of analysis, and independent assessment indicates that arbitrary code execution is unproven-only denial of service or crash is reliably reachable.
Code execution in GNU Emacs versions prior to 31.2 occurs when Flymake performs on-the-fly syntax checking with a language backend other than Emacs Lisp, allowing code embedded in an untrusted file to run with the privileges of the user who opened or edited it. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is local and requires the victim to open a malicious file, but needs no privileges and can fully compromise confidentiality, integrity, and availability of that user's session; the flaw is tracked by Red Hat as CVE-2026-96442 with a vendor score of 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is concentrated in developer and administration workstations where Emacs commonly opens untrusted source files from downloads, mail attachments, or repositories.
Unbounded memory growth in rpcbind allows remote, unauthenticated attackers to degrade or exhaust service availability by flooding the daemon with unique RPC requests that it records in statistics lists which are never pruned. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact, and affects rpcbind as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4. No public exploit code was identified at time of analysis, and exposure is limited to hosts on which the rpcbind service (typically TCP/UDP port 111) is network-reachable, because the attack requires no authentication, no user interaction and no non-default configuration.
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. Exploitation requires valid agent-level credentials and the default ACL configuration, and no public exploit code has been identified at time of analysis, so this is a privilege escalation inside an existing trusted role rather than unauthenticated access.
Privileged users inside a QEMU guest running on the Q35 machine type with the KVM accelerator can abuse the VAPIC setup hypercall (hw/i386/vapic.c) to break SMM isolation, because the code fails to verify that a writable RAM alias stays inside the option ROM window. By repositioning that alias over chipset-locked SMRAM, an attacker with root-equivalent guest access defeats D_LCK protection and injects code into System Management Mode memory, which QEMU scores as a scope-changing, total-impact compromise (CVSS 8.2). Exploitation is local to the guest with high privileges required (AV:L, PR:H, S:C), publicly available exploit code exists according to the CISA SSVC assessment, but there is no confirmed active exploitation and EPSS is low at 0.20% (10th percentile).
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Shell command injection in the Cockpit 389 Console allows an LDAP user with delegated entry-creation privileges to achieve root code execution on the directory server host. The 389-ds-base package, as deployed in Red Hat Directory Server 11/12/13 and RHEL 6-10, constructs ldapsearch commands by embedding LDAP distinguished names directly into shell strings without escaping metacharacters. An attacker controlling LDAP write access can plant a malicious DN; when a Cockpit administrator views that entry, injected shell commands execute with root privileges. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated integrity compromise in 389 Directory Server (shipped as Red Hat Directory Server 11/12/13 and bundled in RHEL 6-10) allows anonymous LDAP clients to bypass SELFDN-based access control checks. The SELFDN ACI bind-rule evaluator incorrectly equates an anonymous client's empty bind DN with an empty stored attribute value in a target directory entry, satisfying an ACI that was intended to permit only a matching authenticated identity. Exploitation enables anonymous directory modifications - including adding or altering entries - that SELFDN ACIs were designed to restrict to specific authenticated users. No public exploit has been identified at time of analysis.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Command injection in rpmuncompress allows a local attacker to execute arbitrary commands under the invoking user's context by supplying an archive file whose filename contains shell metacharacters. Affecting all actively supported Red Hat Enterprise Linux versions (6 through 10) and Red Hat Hardened Images, the flaw is triggered when a user or automated build pipeline invokes rpmuncompress on a maliciously named archive. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and broad RHEL enterprise deployment footprint make this a meaningful risk for organizations processing untrusted archives in development or CI/CD workflows.
Command injection in rpm's `rpmbuild -t*` subcommand allows arbitrary command execution with build-user privileges when an attacker controls the path or filename of a tarball being processed. The vulnerability arises because shell metacharacters in tarball names are not sanitized before being passed to a shell invocation inside rpmbuild. Exploitation is most realistic in automated CI/CD pipelines that fetch externally supplied artifact archives and pass them directly to rpmbuild, a common pattern in open-source package maintainer workflows. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.
Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.
Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.