Red Hat Enterprise Linux 6
Monthly
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Buffer overflow in GIMP's GIF image loading component allows arbitrary code execution when a victim opens a specially crafted GIF file. This local‑attack vulnerability (CVSS 3.1: AV:L/PR:N/UI:R) can lead to full compromise of the user's session. No public exploit has been identified, and EPSS exploitation probability is very low (0.01 %).
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in GIMP's file-xwd plugin allows a crafted XWD image file to trigger an application crash or leak partial heap memory contents into the rendered image output. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when they open a malicious XWD file; the plugin fails to cross-validate image width and bytes-per-line parameters against the allocated buffer size, permitting an out-of-bounds read. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world urgency in the low-to-moderate range.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Signed integer overflow in GIMP's file-fli plugin causes application crashes when processing maliciously crafted FLI animation files, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where incorrect multiplication of image width and height during buffer size calculation can overflow a signed integer, producing an invalid allocation. No public exploit code or active exploitation has been identified; impact is strictly limited to availability, with no confidentiality or integrity consequences.
Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Directory Server 11-13) allows unauthenticated remote attackers - when the default anonymous access setting is active - to manipulate replication metadata, purge changelog records, and abort administrator-initiated cleanup tasks. The affected operations are replication-maintenance primitives that bypass the authorization layer entirely (CWE-862), meaning no account or session is required under default configuration. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the network-accessible, zero-authentication attack surface in a widely deployed enterprise directory server makes this a notable availability and integrity risk.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in `print_hw_addr()` and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SSRF bypass in stunnel 5.79 and earlier allows authenticated SOCKS proxy clients to circumvent intended localhost access restrictions by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) in proxy requests. Exploitation reaches loopback-bound services on the stunnel host - services deliberately isolated from external network access - potentially exposing internal APIs, administrative interfaces, or other localhost-only endpoints. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
GNU tar's --one-top-level extraction mode fails to confine hardlink targets to the designated top-level directory, allowing a crafted archive to plant hardlinks that escape the intended extraction boundary. When combined with a preexisting symbolic link already present under the working directory, an attacker who can induce a victim to extract a malicious archive may read or write files outside the intended extraction scope on systems running affected RHEL versions (6 through 10) and Red Hat Hardened Images. No public exploit has been identified at time of analysis, and exploitation requires both user interaction and a specific environmental pre-condition, keeping real-world risk moderate despite GNU tar's ubiquitous deployment.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Buffer overflow in GIMP's GIF image loading component allows arbitrary code execution when a victim opens a specially crafted GIF file. This local‑attack vulnerability (CVSS 3.1: AV:L/PR:N/UI:R) can lead to full compromise of the user's session. No public exploit has been identified, and EPSS exploitation probability is very low (0.01 %).
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in GIMP's file-xwd plugin allows a crafted XWD image file to trigger an application crash or leak partial heap memory contents into the rendered image output. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when they open a malicious XWD file; the plugin fails to cross-validate image width and bytes-per-line parameters against the allocated buffer size, permitting an out-of-bounds read. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world urgency in the low-to-moderate range.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Signed integer overflow in GIMP's file-fli plugin causes application crashes when processing maliciously crafted FLI animation files, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where incorrect multiplication of image width and height during buffer size calculation can overflow a signed integer, producing an invalid allocation. No public exploit code or active exploitation has been identified; impact is strictly limited to availability, with no confidentiality or integrity consequences.
Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Directory Server 11-13) allows unauthenticated remote attackers - when the default anonymous access setting is active - to manipulate replication metadata, purge changelog records, and abort administrator-initiated cleanup tasks. The affected operations are replication-maintenance primitives that bypass the authorization layer entirely (CWE-862), meaning no account or session is required under default configuration. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the network-accessible, zero-authentication attack surface in a widely deployed enterprise directory server makes this a notable availability and integrity risk.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in `print_hw_addr()` and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SSRF bypass in stunnel 5.79 and earlier allows authenticated SOCKS proxy clients to circumvent intended localhost access restrictions by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) in proxy requests. Exploitation reaches loopback-bound services on the stunnel host - services deliberately isolated from external network access - potentially exposing internal APIs, administrative interfaces, or other localhost-only endpoints. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
GNU tar's --one-top-level extraction mode fails to confine hardlink targets to the designated top-level directory, allowing a crafted archive to plant hardlinks that escape the intended extraction boundary. When combined with a preexisting symbolic link already present under the working directory, an attacker who can induce a victim to extract a malicious archive may read or write files outside the intended extraction scope on systems running affected RHEL versions (6 through 10) and Red Hat Hardened Images. No public exploit has been identified at time of analysis, and exploitation requires both user interaction and a specific environmental pre-condition, keeping real-world risk moderate despite GNU tar's ubiquitous deployment.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.