Red Hat Enterprise Linux 6
Monthly
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LDAP client to crash the server by sending an oversized UNBIND packet over a SASL integrity-protected connection. The oversized data overflows a fixed 512-byte heap receive buffer in sasl_io_recv() (sasl_io.c), and in FreeIPA / Red Hat IdM any domain user, enrolled host, or service account with a valid Kerberos ticket can trigger it after GSSAPI authentication. There is no public exploit identified at time of analysis, and this flaw is distinct from the earlier CVE-2025-14905 schema.c overflow, which did not fix this code path.
Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. Because ad_gpo_extract_smb_components() fails to sanitize '..' sequences in the gPCFileSysPath LDAP attribute (CWE-23), an actor holding AD GPO management rights can force an SSSD-enrolled host to write attacker-controlled files outside the GPO cache as root, injecting Kerberos configuration to bypass authentication. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user with write access to any subtree to inject a malicious sudoRole object and gain root-level sudo on every SSSD-enrolled host. The flaw exists because, when ldap_sudo_search_base is left unset, SSSD searches the entire directory tree for sudoRole objects, trusting rules planted anywhere in the DIT. Rated CVSS 8.8 by Red Hat and reported against RHEL 6 through 10 and OpenShift Container Platform 4; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap memory corruption in GIMP's PSD (Photoshop) file parser allows a malicious .psd image to overflow an integer in read_RLE_channel(), producing an undersized heap allocation for the RLE row-length table that is then overwritten row-by-row, potentially yielding denial of service or arbitrary code execution. The flaw affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9 and is triggered when a victim opens or imports a crafted PSD file. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based memory corruption in GIMP's PNM image parser lets an attacker execute code or crash the application when a victim opens a malicious PNM/PBM/PGM/PPM file. The flaw is an off-by-one in pnmscanner_gettoken() that writes a null terminator one byte past a stack buffer; it is local and requires the user to open the crafted file (UI:R). No public exploit is identified at time of analysis, and EPSS is low (0.12%), consistent with the CISA SSVC 'Exploitation: none' judgment.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) image format parser lets an attacker achieve arbitrary code execution or crash the application when a victim opens a maliciously crafted PSP file. The flaw stems from incorrect buffer-size arithmetic on low bit-depth images, and affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation requires local file-open interaction (CVSS 7.3).
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter across Red Hat Enterprise Linux 6 through 10, where an integer overflow triggered by specially crafted print data can corrupt memory. This is an incomplete-fix follow-up to CVE-2026-8631, meaning the original patch did not fully close the flaw, and no public exploit has been identified at time of analysis. The Red Hat CVSS of 9.8 reflects a network-reachable, unauthenticated attack path, though realistic exploitation depends on how the CUPS print pipeline is exposed.
Memory corruption in GIMP's Paint Shop Pro (.psp) import parser lets an attacker crash the application or possibly execute code by persuading a victim to open a crafted PSP image file. The root cause is a double-free (CWE-415) in the read_layer_block() routine; exploitation requires local user interaction to open the file and results in per-user, client-side compromise rather than server-side or unattended exploitation. There is no public exploit identified at time of analysis, the SSVC decision framework rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.12% (2nd percentile), yet Red Hat tracks the defect across RHEL 6 through 9 and a vendor patch plus an upstream commit are available.
Denial of service in libarchive's RAR5 reader allows remote attackers to crash applications that decompress untrusted RAR5 archives via a double-free (CWE-415) of the stale filtered_buf pointer. Reported by Red Hat and affecting libarchive as shipped across Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, the flaw is triggered purely by parsing a malicious archive entry. No public exploit has been identified and the issue is not in CISA KEV; impact is limited to availability (CVSS 7.5, A:H only) with no code execution or data exposure claimed.
Local privilege escalation in the cifs-utils cifs.upcall helper allows low-privileged Linux users to gain root by abusing the kernel request_key interface to load a malicious NSS module inside an attacker-controlled mount namespace. The root-owned helper fails to drop privileges before performing user-name resolution, so the attacker's NSS module executes with full root capabilities. No public exploit identified at time of analysis, but the bug affects every supported Red Hat Enterprise Linux release (6 through 10) and OpenShift Container Platform 4, making it a high-priority hardening fix for any host with CIFS/SMB client functionality.
Out-of-bounds read in GStreamer's VMnc decoder allows remote attackers to crash the application or disclose memory contents when a victim opens a maliciously crafted VMnc video file. The flaw stems from a signed integer overflow in payload-size arithmetic that bypasses a length check when cursor dimensions are abnormally large. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a connecting client, potentially leading to remote code execution or denial of service. The flaw stems from validating rectangle area instead of individual dimensions, letting attacker-controlled rectangles extend beyond the framebuffer. No public exploit identified at time of analysis, though the issue affects GStreamer as shipped across Red Hat Enterprise Linux 6 through 10.
Out-of-bounds read in the VA JPEG decoder shipped in GStreamer's gst-plugins-bad allows a remote attacker to crash the decoder or potentially leak adjacent memory contents when a victim opens a maliciously crafted JPEG file. The flaw stems from the JPEG parser trusting a segment-length value from the bitstream without verifying it fits within the buffer, and affects Red Hat Enterprise Linux 6 through 10 where the plugin is consumed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Local privilege escalation via arbitrary root-owned file overwrite affects libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8. The event scripts write output using shell redirections that lack the O_NOFOLLOW flag, so a local low-privileged user who plants a symlink in a writable crash-dump path can cause the root shell to follow it and clobber any file on the system, which can be leveraged for full system compromise. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 5th percentile).
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows a low-privileged local user to race the ChownProblemDir method against still-running post-create event handlers. By invoking ChownProblemDir while privileged event scripts hold a write lock on the dump directory, the attacker gains filesystem ownership of files being written by root-context handlers, enabling tampering with privileged output and potential privilege escalation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows any unprivileged local user to win a TOCTOU race against the SetElement method, writing arbitrary text files into root-owned dump directories. By exploiting the gap between dump directory creation and post-create event execution, an attacker bypasses package validation and persists crash data for unpackaged binaries inside privileged paths, with no public exploit identified at time of analysis.
Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash the LDAP service or achieve remote code execution after a successful SASL bind with integrity protection (SSF > 0). The flaw stems from an integer overflow in sasl_io_start_packet() that bypasses the nsslapd-maxsasliosize ceiling, enabling roughly 2 MB of attacker-controlled heap corruption. No public exploit identified at time of analysis, and the impact is amplified in FreeIPA and Red Hat Identity Management deployments where any enrolled user, host, or service principal qualifies as an authenticated attacker.
Root command injection in dracut's legacy DHCP path allows adjacent-network attackers to execute arbitrary commands inside the initramfs by sending crafted DHCP options (e.g., malicious hostname) that are written unescaped into temporary shell scripts. The flaw affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4, granting full system compromise during early boot. No public exploit identified at time of analysis, and EPSS is low (0.16%, 36th percentile), but SSVC rates technical impact as total.
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) allows unauthenticated network attackers to crash the LDAP daemon by exploiting an unchecked BER structure allocation in the dereference control plugin when the host is under memory pressure. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.09%, 25th percentile), but the unauthenticated network-reachable nature warrants prompt patching of internet-facing or business-critical directory services.
Out-of-bounds heap write in X.Org X server and Xwayland DRI2 buffer handling allows a local authenticated client to corrupt server memory by requesting multiple DRI2BufferBackLeft attachments alongside one DRI2BufferFrontLeft. Successful exploitation crashes the display server or, when the X server runs setuid root (a still-common legacy deployment), enables local privilege escalation to root. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in SyncChangeCounter() that a local authenticated attacker can trigger by orchestrating two client connections - one creating multiple SyncCounters, the other destroying them while they are being changed. On systems where the X server still runs as root (common on legacy Linux setups), successful exploitation yields root code execution; at minimum it crashes the display server. No public exploit identified at time of analysis, but the bug is confirmed by Red Hat and a fix has landed upstream in xserver.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in FreeCounter() when SyncCounter objects are destroyed across multiple client connections. Authenticated local attackers on affected Red Hat Enterprise Linux 6 through 10 systems can crash the server or escalate to root when the X server runs with elevated privileges. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.
Stack-based buffer overflow in X.Org X server and Xwayland's _XkbSetMapChecks() function allows local authenticated attackers to crash the server or potentially escalate privileges to root when the X server runs with elevated privileges. The flaw resides in CheckKeyTypes() writing to a fixed mapWidths[256] stack buffer at a client-controlled offset, affecting Red Hat Enterprise Linux versions 6 through 10. No public exploit identified at time of analysis, but an upstream fix has been merged into the xserver repository.
Local privilege escalation in the X.Org X server and Xwayland stems from a stack-based buffer overflow during font alias resolution, where a 256-byte server-side stack buffer is overrun by libXfont2 alias target names of up to 1023 bytes. An authenticated local attacker who can influence font alias files can crash the server or, when the X server runs as root, escalate to root privileges. No public exploit is identified at time of analysis and CVSS is 7.8 (Local/Low complexity/Low privileges).
Local privilege escalation in X.Org X server and Xwayland enables authenticated local users to trigger a use-after-free in miSyncDestroyFence() by racing two client connections against a shared fence object. Successful exploitation can crash the display server or escalate privileges to root when the X server runs as root, which remains common on legacy and embedded Linux deployments. No public exploit identified at time of analysis, but an upstream fix has been committed by the X.Org maintainers.
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Certificate validation bypass in GnuTLS (as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images) lets a remote attacker defeat hostname verification: when a certificate carries an oversized Subject Alternative Name, the library incorrectly abandons SAN matching and falls back to the legacy Common Name field, accepting certificates it should reject. An attacker positioned to intercept traffic can present such a certificate to impersonate a trusted server and conduct spoofing or man-in-the-middle attacks against TLS clients that rely on GnuTLS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data.
Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.
An out-of-bounds read in the X.Org X server's XKB geometry handling, specifically in CheckSetGeom() and XkbAddGeomKeyAlias(), allows an attacker who can open an X11 client connection to the server to read uninitialized or out-of-bounds memory or to crash the X server. Affected builds are those shipped in Red Hat Enterprise Linux 6 through 10 and the SUSE products covered by the SUSE-SU-2026:1328 through 1335 and SUSE-SU-2026:21211 updates; the supplied CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H), while our assessment lowers privileges required to low because a connection must ordinarily clear X authorization such as an xauth cookie before reaching the vulnerable code. No public exploit code was identified at time of analysis (EPSS 0.01%, 2nd percentile; SSVC exploitation: none), but the vuln.today decision label is act_now, so the divergent signals should be weighed together rather than on the base score alone.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Buffer overflow in GIMP's GIF image loading component allows arbitrary code execution when a victim opens a specially crafted GIF file. This local‑attack vulnerability (CVSS 3.1: AV:L/PR:N/UI:R) can lead to full compromise of the user's session. No public exploit has been identified, and EPSS exploitation probability is very low (0.01 %).
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Heap-based out-of-bounds read in libtheora's AVI parser allows local attackers with limited privileges to trigger application crashes or leak heap memory via specially crafted AVI files with truncated header sub-chunks. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and requires user interaction (opening a malicious file), with real-world impact limited to denial-of-service and potential information disclosure rather than code execution.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
Out-of-bounds read in Eye of GNOME (eog) when parsing a crafted PNG with malformed ICC color-profile metadata allows an attacker who convinces a user to open the image to crash the viewer and potentially expose limited memory contents. Affected deployments are GNOME desktop systems, including the Red Hat Enterprise Linux 6 through 9 package scope identified in CPE data; headless servers without eog installed are not exposed. Exploitation requires user interaction via a local vector, and no public exploit or CISA KEV confirmation was identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
dnsmasq's DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option when the server processes a single DHCPv6 packet from an attacker on the same local link. The over-read byte is neither returned to the client nor logged, and no crash or confirmed information disclosure has been demonstrated; the independent assessment scores confidentiality, integrity, and availability impact as none, so real-world risk is low despite the genuine memory-safety defect. No CISA KEV entry or public exploit code was identified at time of analysis.
DHCP lease metadata disclosure in dnsmasq (CVE-2026-93010) occurs when the DHCP leasequery feature has been switched on without an allow-list of permitted query sources, letting any host on the local network pull lease records - assigned IP addresses, MAC addresses, hostnames and related lease metadata. The package is shipped across Red Hat Enterprise Linux 6 through 10 and is bundled into Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform builds, but the vulnerable feature is off unless an administrator explicitly enables it. Severity is capped at a confidentiality-only leak (CVSS 4.3, adjacent-network attack vector), and no public exploit code or active exploitation has been identified at time of analysis.
TFTP file substitution in dnsmasq allows an attacker on the local network to make a later client receive stale, previously cached transfer data instead of the file it requested; in PXE network-boot deployments this can substitute attacker-chosen boot content for a victim machine, giving both confidentiality and integrity impact. The flaw only exists when dnsmasq is running with its TFTP server feature enabled (a non-default configuration used for network boot), requires adjacent-network access (AV:A) with no authentication (PR:N) and no user interaction (UI:N), but is rated high complexity (AC:H) because the attacker cannot control when another client will request the same file and pick up the cached response. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the vendor-reported CVSS 3.1 score is 6.8, making this a moderate, situational issue rather than an emergency; Red Hat tracks it for remediation within the current monthly cycle.
Denial of service against dnsmasq's TCP DNS service: remote attackers can occupy the entire small fixed pool of TCP child processes by holding idle connections open to port 53, which blocks new TCP DNS queries and any DNSSEC validation that depends on TCP fallback. The flaw is packaged in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform 13 (Queens) and 18.0, so any of those deployments exposing TCP/53 to untrusted networks is in scope. Impact is confined to availability and is time-bounded rather than permanent - UDP resolution keeps working and occupied slots are released after a fixed lifetime - and no public exploit identified at time of analysis.
dnsmasq builds that include the DNSSEC validator and have validation enabled at runtime can write a few bytes past an internal domain-name buffer when converting names to and from DNS wire format, corrupting adjacent heap metadata. Only deployments where DNSSEC support was compiled in and DNSSEC validation is switched on are exposed; the default dnsmasq build omits DNSSEC entirely, and exploitation further requires an attacker to make the resolver validate a crafted DNSSEC response, for example through a spoofed or attacker-controlled answer for a signed name. Rated CVSS 5.3 (integrity-only, low impact) and no public exploit identified at time of analysis; the priority signal is this_month, not immediate action.
A DNS cache-poisoning flaw in dnsmasq (CWE-345, insufficient verification of data authenticity) lets a malicious or compromised upstream resolver inject cached records for names outside its authoritative zone when dnsmasq follows a CNAME in a response. Only split-DNS deployments that forward specific domains to a designated upstream are realistically exposed, since the attacker must already occupy that trusted upstream position; standard single-forwarder or root-hint setups are far less affected. Impact is integrity-only (attacker-chosen addresses returned to later clients), rated CVSS 6.8 with AC:H, and no public exploit code or KEV entry was identified at time of analysis, so priority follows the vendor's this-month cadence rather than emergency response.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LDAP client to crash the server by sending an oversized UNBIND packet over a SASL integrity-protected connection. The oversized data overflows a fixed 512-byte heap receive buffer in sasl_io_recv() (sasl_io.c), and in FreeIPA / Red Hat IdM any domain user, enrolled host, or service account with a valid Kerberos ticket can trigger it after GSSAPI authentication. There is no public exploit identified at time of analysis, and this flaw is distinct from the earlier CVE-2025-14905 schema.c overflow, which did not fix this code path.
Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. Because ad_gpo_extract_smb_components() fails to sanitize '..' sequences in the gPCFileSysPath LDAP attribute (CWE-23), an actor holding AD GPO management rights can force an SSSD-enrolled host to write attacker-controlled files outside the GPO cache as root, injecting Kerberos configuration to bypass authentication. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user with write access to any subtree to inject a malicious sudoRole object and gain root-level sudo on every SSSD-enrolled host. The flaw exists because, when ldap_sudo_search_base is left unset, SSSD searches the entire directory tree for sudoRole objects, trusting rules planted anywhere in the DIT. Rated CVSS 8.8 by Red Hat and reported against RHEL 6 through 10 and OpenShift Container Platform 4; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap memory corruption in GIMP's PSD (Photoshop) file parser allows a malicious .psd image to overflow an integer in read_RLE_channel(), producing an undersized heap allocation for the RLE row-length table that is then overwritten row-by-row, potentially yielding denial of service or arbitrary code execution. The flaw affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9 and is triggered when a victim opens or imports a crafted PSD file. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based memory corruption in GIMP's PNM image parser lets an attacker execute code or crash the application when a victim opens a malicious PNM/PBM/PGM/PPM file. The flaw is an off-by-one in pnmscanner_gettoken() that writes a null terminator one byte past a stack buffer; it is local and requires the user to open the crafted file (UI:R). No public exploit is identified at time of analysis, and EPSS is low (0.12%), consistent with the CISA SSVC 'Exploitation: none' judgment.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) image format parser lets an attacker achieve arbitrary code execution or crash the application when a victim opens a maliciously crafted PSP file. The flaw stems from incorrect buffer-size arithmetic on low bit-depth images, and affects GIMP as shipped across Red Hat Enterprise Linux 6 through 9. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation requires local file-open interaction (CVSS 7.3).
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter across Red Hat Enterprise Linux 6 through 10, where an integer overflow triggered by specially crafted print data can corrupt memory. This is an incomplete-fix follow-up to CVE-2026-8631, meaning the original patch did not fully close the flaw, and no public exploit has been identified at time of analysis. The Red Hat CVSS of 9.8 reflects a network-reachable, unauthenticated attack path, though realistic exploitation depends on how the CUPS print pipeline is exposed.
Memory corruption in GIMP's Paint Shop Pro (.psp) import parser lets an attacker crash the application or possibly execute code by persuading a victim to open a crafted PSP image file. The root cause is a double-free (CWE-415) in the read_layer_block() routine; exploitation requires local user interaction to open the file and results in per-user, client-side compromise rather than server-side or unattended exploitation. There is no public exploit identified at time of analysis, the SSVC decision framework rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.12% (2nd percentile), yet Red Hat tracks the defect across RHEL 6 through 9 and a vendor patch plus an upstream commit are available.
Denial of service in libarchive's RAR5 reader allows remote attackers to crash applications that decompress untrusted RAR5 archives via a double-free (CWE-415) of the stale filtered_buf pointer. Reported by Red Hat and affecting libarchive as shipped across Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, the flaw is triggered purely by parsing a malicious archive entry. No public exploit has been identified and the issue is not in CISA KEV; impact is limited to availability (CVSS 7.5, A:H only) with no code execution or data exposure claimed.
Local privilege escalation in the cifs-utils cifs.upcall helper allows low-privileged Linux users to gain root by abusing the kernel request_key interface to load a malicious NSS module inside an attacker-controlled mount namespace. The root-owned helper fails to drop privileges before performing user-name resolution, so the attacker's NSS module executes with full root capabilities. No public exploit identified at time of analysis, but the bug affects every supported Red Hat Enterprise Linux release (6 through 10) and OpenShift Container Platform 4, making it a high-priority hardening fix for any host with CIFS/SMB client functionality.
Out-of-bounds read in GStreamer's VMnc decoder allows remote attackers to crash the application or disclose memory contents when a victim opens a maliciously crafted VMnc video file. The flaw stems from a signed integer overflow in payload-size arithmetic that bypasses a length check when cursor dimensions are abnormally large. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a connecting client, potentially leading to remote code execution or denial of service. The flaw stems from validating rectangle area instead of individual dimensions, letting attacker-controlled rectangles extend beyond the framebuffer. No public exploit identified at time of analysis, though the issue affects GStreamer as shipped across Red Hat Enterprise Linux 6 through 10.
Out-of-bounds read in the VA JPEG decoder shipped in GStreamer's gst-plugins-bad allows a remote attacker to crash the decoder or potentially leak adjacent memory contents when a victim opens a maliciously crafted JPEG file. The flaw stems from the JPEG parser trusting a segment-length value from the bitstream without verifying it fits within the buffer, and affects Red Hat Enterprise Linux 6 through 10 where the plugin is consumed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Local privilege escalation via arbitrary root-owned file overwrite affects libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8. The event scripts write output using shell redirections that lack the O_NOFOLLOW flag, so a local low-privileged user who plants a symlink in a writable crash-dump path can cause the root shell to follow it and clobber any file on the system, which can be leveraged for full system compromise. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 5th percentile).
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows a low-privileged local user to race the ChownProblemDir method against still-running post-create event handlers. By invoking ChownProblemDir while privileged event scripts hold a write lock on the dump directory, the attacker gains filesystem ownership of files being written by root-context handlers, enabling tampering with privileged output and potential privilege escalation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows any unprivileged local user to win a TOCTOU race against the SetElement method, writing arbitrary text files into root-owned dump directories. By exploiting the gap between dump directory creation and post-create event execution, an attacker bypasses package validation and persists crash data for unpackaged binaries inside privileged paths, with no public exploit identified at time of analysis.
Heap buffer overflow in 389 Directory Server (389-ds-base) SASL I/O layer allows authenticated remote attackers to crash the LDAP service or achieve remote code execution after a successful SASL bind with integrity protection (SSF > 0). The flaw stems from an integer overflow in sasl_io_start_packet() that bypasses the nsslapd-maxsasliosize ceiling, enabling roughly 2 MB of attacker-controlled heap corruption. No public exploit identified at time of analysis, and the impact is amplified in FreeIPA and Red Hat Identity Management deployments where any enrolled user, host, or service principal qualifies as an authenticated attacker.
Root command injection in dracut's legacy DHCP path allows adjacent-network attackers to execute arbitrary commands inside the initramfs by sending crafted DHCP options (e.g., malicious hostname) that are written unescaped into temporary shell scripts. The flaw affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4, granting full system compromise during early boot. No public exploit identified at time of analysis, and EPSS is low (0.16%, 36th percentile), but SSVC rates technical impact as total.
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 through 10) allows unauthenticated network attackers to crash the LDAP daemon by exploiting an unchecked BER structure allocation in the dereference control plugin when the host is under memory pressure. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.09%, 25th percentile), but the unauthenticated network-reachable nature warrants prompt patching of internet-facing or business-critical directory services.
Out-of-bounds heap write in X.Org X server and Xwayland DRI2 buffer handling allows a local authenticated client to corrupt server memory by requesting multiple DRI2BufferBackLeft attachments alongside one DRI2BufferFrontLeft. Successful exploitation crashes the display server or, when the X server runs setuid root (a still-common legacy deployment), enables local privilege escalation to root. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in SyncChangeCounter() that a local authenticated attacker can trigger by orchestrating two client connections - one creating multiple SyncCounters, the other destroying them while they are being changed. On systems where the X server still runs as root (common on legacy Linux setups), successful exploitation yields root code execution; at minimum it crashes the display server. No public exploit identified at time of analysis, but the bug is confirmed by Red Hat and a fix has landed upstream in xserver.
Local privilege escalation in the X.Org X server and Xwayland arises from a use-after-free in FreeCounter() when SyncCounter objects are destroyed across multiple client connections. Authenticated local attackers on affected Red Hat Enterprise Linux 6 through 10 systems can crash the server or escalate to root when the X server runs with elevated privileges. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.
Stack-based buffer overflow in X.Org X server and Xwayland's _XkbSetMapChecks() function allows local authenticated attackers to crash the server or potentially escalate privileges to root when the X server runs with elevated privileges. The flaw resides in CheckKeyTypes() writing to a fixed mapWidths[256] stack buffer at a client-controlled offset, affecting Red Hat Enterprise Linux versions 6 through 10. No public exploit identified at time of analysis, but an upstream fix has been merged into the xserver repository.
Local privilege escalation in the X.Org X server and Xwayland stems from a stack-based buffer overflow during font alias resolution, where a 256-byte server-side stack buffer is overrun by libXfont2 alias target names of up to 1023 bytes. An authenticated local attacker who can influence font alias files can crash the server or, when the X server runs as root, escalate to root privileges. No public exploit is identified at time of analysis and CVSS is 7.8 (Local/Low complexity/Low privileges).
Local privilege escalation in X.Org X server and Xwayland enables authenticated local users to trigger a use-after-free in miSyncDestroyFence() by racing two client connections against a shared fence object. Successful exploitation can crash the display server or escalate privileges to root when the X server runs as root, which remains common on legacy and embedded Linux deployments. No public exploit identified at time of analysis, but an upstream fix has been committed by the X.Org maintainers.
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Certificate validation bypass in GnuTLS (as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images) lets a remote attacker defeat hostname verification: when a certificate carries an oversized Subject Alternative Name, the library incorrectly abandons SAN matching and falls back to the legacy Common Name field, accepting certificates it should reject. An attacker positioned to intercept traffic can present such a certificate to impersonate a trusted server and conduct spoofing or man-in-the-middle attacks against TLS clients that rely on GnuTLS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data.
Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.
An out-of-bounds read in the X.Org X server's XKB geometry handling, specifically in CheckSetGeom() and XkbAddGeomKeyAlias(), allows an attacker who can open an X11 client connection to the server to read uninitialized or out-of-bounds memory or to crash the X server. Affected builds are those shipped in Red Hat Enterprise Linux 6 through 10 and the SUSE products covered by the SUSE-SU-2026:1328 through 1335 and SUSE-SU-2026:21211 updates; the supplied CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H), while our assessment lowers privileges required to low because a connection must ordinarily clear X authorization such as an xauth cookie before reaching the vulnerable code. No public exploit code was identified at time of analysis (EPSS 0.01%, 2nd percentile; SSVC exploitation: none), but the vuln.today decision label is act_now, so the divergent signals should be weighed together rather than on the base score alone.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Buffer overflow in GIMP's GIF image loading component allows arbitrary code execution when a victim opens a specially crafted GIF file. This local‑attack vulnerability (CVSS 3.1: AV:L/PR:N/UI:R) can lead to full compromise of the user's session. No public exploit has been identified, and EPSS exploitation probability is very low (0.01 %).
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Heap-based out-of-bounds read in libtheora's AVI parser allows local attackers with limited privileges to trigger application crashes or leak heap memory via specially crafted AVI files with truncated header sub-chunks. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and requires user interaction (opening a malicious file), with real-world impact limited to denial-of-service and potential information disclosure rather than code execution.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
Out-of-bounds read in Eye of GNOME (eog) when parsing a crafted PNG with malformed ICC color-profile metadata allows an attacker who convinces a user to open the image to crash the viewer and potentially expose limited memory contents. Affected deployments are GNOME desktop systems, including the Red Hat Enterprise Linux 6 through 9 package scope identified in CPE data; headless servers without eog installed are not exposed. Exploitation requires user interaction via a local vector, and no public exploit or CISA KEV confirmation was identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
dnsmasq's DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option when the server processes a single DHCPv6 packet from an attacker on the same local link. The over-read byte is neither returned to the client nor logged, and no crash or confirmed information disclosure has been demonstrated; the independent assessment scores confidentiality, integrity, and availability impact as none, so real-world risk is low despite the genuine memory-safety defect. No CISA KEV entry or public exploit code was identified at time of analysis.
DHCP lease metadata disclosure in dnsmasq (CVE-2026-93010) occurs when the DHCP leasequery feature has been switched on without an allow-list of permitted query sources, letting any host on the local network pull lease records - assigned IP addresses, MAC addresses, hostnames and related lease metadata. The package is shipped across Red Hat Enterprise Linux 6 through 10 and is bundled into Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform builds, but the vulnerable feature is off unless an administrator explicitly enables it. Severity is capped at a confidentiality-only leak (CVSS 4.3, adjacent-network attack vector), and no public exploit code or active exploitation has been identified at time of analysis.
TFTP file substitution in dnsmasq allows an attacker on the local network to make a later client receive stale, previously cached transfer data instead of the file it requested; in PXE network-boot deployments this can substitute attacker-chosen boot content for a victim machine, giving both confidentiality and integrity impact. The flaw only exists when dnsmasq is running with its TFTP server feature enabled (a non-default configuration used for network boot), requires adjacent-network access (AV:A) with no authentication (PR:N) and no user interaction (UI:N), but is rated high complexity (AC:H) because the attacker cannot control when another client will request the same file and pick up the cached response. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the vendor-reported CVSS 3.1 score is 6.8, making this a moderate, situational issue rather than an emergency; Red Hat tracks it for remediation within the current monthly cycle.
Denial of service against dnsmasq's TCP DNS service: remote attackers can occupy the entire small fixed pool of TCP child processes by holding idle connections open to port 53, which blocks new TCP DNS queries and any DNSSEC validation that depends on TCP fallback. The flaw is packaged in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform 13 (Queens) and 18.0, so any of those deployments exposing TCP/53 to untrusted networks is in scope. Impact is confined to availability and is time-bounded rather than permanent - UDP resolution keeps working and occupied slots are released after a fixed lifetime - and no public exploit identified at time of analysis.
dnsmasq builds that include the DNSSEC validator and have validation enabled at runtime can write a few bytes past an internal domain-name buffer when converting names to and from DNS wire format, corrupting adjacent heap metadata. Only deployments where DNSSEC support was compiled in and DNSSEC validation is switched on are exposed; the default dnsmasq build omits DNSSEC entirely, and exploitation further requires an attacker to make the resolver validate a crafted DNSSEC response, for example through a spoofed or attacker-controlled answer for a signed name. Rated CVSS 5.3 (integrity-only, low impact) and no public exploit identified at time of analysis; the priority signal is this_month, not immediate action.
A DNS cache-poisoning flaw in dnsmasq (CWE-345, insufficient verification of data authenticity) lets a malicious or compromised upstream resolver inject cached records for names outside its authoritative zone when dnsmasq follows a CNAME in a response. Only split-DNS deployments that forward specific domains to a designated upstream are realistically exposed, since the attacker must already occupy that trusted upstream position; standard single-forwarder or root-hint setups are far less affected. Impact is integrity-only (attacker-chosen addresses returned to later clients), rated CVSS 6.8 with AC:H, and no public exploit code or KEV entry was identified at time of analysis, so priority follows the vendor's this-month cadence rather than emergency response.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.