Red Hat Enterprise Linux 6
Monthly
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated state-notification requests sent to a network-reachable rpc.statd service in nfs-utils cause memory allocated during callback processing to never be released, producing continuous memory growth that can degrade or crash the service and exhaust host resources. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but exploitation is not trivial: a single request is insufficient because the attacker must sustain a stream of requests long enough to exhaust memory, which is why the vector carries AC:H and the impact is availability-only (C:N/I:N/A:H, base score 5.9). Exposure is limited in practice because rpc.statd only runs when NFSv3 locking services are active and is normally bound to internal or trusted networks rather than the public internet, so firewalled or default deployments are not reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; this is a genuine but moderate-priority availability issue rather than a top-tier emergency, and affected services can be recovered by a restart.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Denial of service in libtirpc allows an authenticated remote RPC client to exhaust server memory by sending oversized wrapped-data requests to an RPC service that is configured with RPCSEC_GSS integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection. Only services explicitly running in that non-default, Kerberos-backed mode are exposed - most commonly NFS deployments on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - and the impact is availability-only (CVSS 6.5, A:H) with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it warrants medium-priority patch tracking rather than emergency response, although affected RPC services can become unstable or terminate under the resource exhaustion.
Local denial of service in the nfs-utils fsidd daemon affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4; an authenticated local user with access to the fsidd Unix domain socket can send a malformed request that omits required arguments, triggering a CWE-617 assertion failure and crashing the daemon. The service remains unavailable for filesystem identifier lookups until restarted, giving this a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Crafted ISO-2022 encoded text passed to the m17n-lib decoder can trigger an uninitialized stack memory read, potentially leaking small amounts of process memory if the application then returns or displays the decoded output to the attacker. The issue is rated low severity (CVSS 2.5, AV:L/AC:H/UI:R, unauthenticated per vector PR:N) and affects multilanguage library builds shipped across Red Hat Enterprise Linux 6 through 10, though any application embedding m17n-lib's ISO-2022 handling is in scope. No public exploit identified at time of analysis; risk is gated by the fact that the deploying application must both decode attacker-supplied ISO-2022 input and reflect the decoded result back, which is uncommon in typical installations.
Local privilege escalation and arbitrary code execution in the BusyBox tar applet (CVE-2026-108119) allow an attacker who supplies a crafted tar archive to create or replace files outside the extraction directory when the archive is extracted with elevated privileges. The flaw is a CWE-59 link-following issue in the applet's deferred symlink/hardlink creation path, with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), affecting BusyBox as shipped in Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No public exploit identified at time of analysis; exploitation requires a privileged user or process to actively extract the malicious archive, and the specific archive construction plus directory-reuse timing makes this high-complexity and local-only.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.
SSSD configured with the Microsoft Entra ID identity provider fails to neutralize single quotes in lookup names before embedding them into Microsoft Graph OData queries, enabling an authenticated local attacker to inject filter syntax. This can broaden user or group searches, leading to information disclosure of unintended directory objects and a denial of service through excessive processing and cache population. The CVSS vector (AV:L/PR:L) confirms the attack is local and requires low privileges, and exploitation is only possible when the non-default Entra ID backend is enabled; no public exploit or active exploitation is reported, and no EPSS score was provided.
Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).
Denial of service in SSSD (the System Security Services Daemon) allows remote unauthenticated attackers to crash the daemon by presenting a certificate that is missing the expected Security Identifier (SID) extension during authentication or lookup operations. Only deployments explicitly configured with SID-based certificate mapping rules reach the vulnerable code path, since the certificate-to-user lookup logic dereferences the SID extension without first confirming it exists; standard installations that do not use SID-based certificate mapping are not affected. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, availability-only) and, per available intelligence, no public exploit code exists and exploitation has not been confirmed as active - no public exploit identified at time of analysis.
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Local denial of service in the SSSD Kerberos Credential Manager (KCM) responder allows an authenticated local user to exhaust host memory and make the service unresponsive by holding a persistent connection open while repeatedly storing and destroying Kerberos credentials. The flaw is a resource-lifecycle defect (CWE-772): cached objects are not released when credentials are removed, so memory grows monotonically until the responder stalls. Exploitation requires a valid local account and sustained store-then-destroy activity, yields availability impact only (CVSS 5.5, AV:L/PR:L/UI:N/A:H), and does not provide code execution or privilege escalation; no public exploit code or confirmed active exploitation was identified at time of analysis, and systems that do not use the KCM responder are not affected.
The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.
Authentication bypass in SSSD permits a user with valid credentials for an already-expired account to authenticate to the system when SSSD is configured to enforce account expiration using LDAP shadow attributes and the expiration value is stored as zero. This moderate-severity logic flaw (CVSS 5.4, CWE-193) affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4; exploitation requires the non-default shadowExpire=0 configuration and valid credentials for the expired account. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in SSSD's autofs responder allows an authenticated local unprivileged user to repeatedly request master automount map updates, triggering global cache invalidation and forcing repeated backend directory lookups, which degrades automount availability and elevates resource consumption. Affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when SSSD-backed automount maps are served from a backend directory provider such as LDAP or Active Directory. This is a moderate-priority local availability issue (CVSS 5.5) with no public exploit code identified at time of analysis.
Memory exhaustion in the SSSD autofs responder can let a local, authenticated unprivileged user deny service on affected hosts by holding an open client connection while repeatedly submitting valid requests, since per-request memory is only reclaimed when the connection closes. The flaw affects SSSD deployments on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, but the vulnerable code path is only reachable when the autofs responder is explicitly enabled in sssd.conf - a non-default configuration. Exploitation is limited to local access (AV:L/PR:L) with no impact on confidentiality or integrity, so it is correctly rated medium (CVSS 5.5); no CISA KEV entry and no public exploit code have been identified at time of analysis, and a realistic impact generally requires a shared, multi-user host where one user's resource consumption degrades service for others.
Crashing the SSSD autofs responder process via a crafted request to its UNIX socket allows a local, low-privileged attacker to cause a denial of service on affected Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 systems. The vulnerability stems from improper buffer offset calculation during request parsing, leading to an out-of-bounds read (CWE-125) that terminates the responder process; it carries a CVSS 3.3 (Low) score with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the autofs responder service must be enabled for the flaw to be exploitable.
A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
GEGL's Radiance HDR loader reads past the end of a memory-mapped image when a crafted .hdr file declares a scanline width larger than the actual data present in an uncompressed scanline, crashing the application that consumes the library - most notably GIMP, which uses GEGL for image processing. Any local user who opens such a file is affected; no authentication is required to the library, but the attacker must convince a victim to open the crafted file (UI:R), and the impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, consistent with a low-priority, local denial-of-service rather than a code-execution primitive.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
Local denial of service in the dash shell affects builds compiled without libc fnmatch, where the internal pmatch() matcher handles the '*' wildcard by unbounded recursion over candidate positions. A local attacker who can plant filenames in a directory that later gets globbed - or otherwise feed the internal matcher - can supply a short multi-star pattern such as *.*.*.*.*.tar.gz and drive excessive CPU consumption in the affected shell process. The issue requires a non-default build configuration (PR:L, AV:L, no remote reachability, no privilege escalation or data disclosure), maps to CWE-1333 (inefficient regular expression complexity) with a CVSS 3.1 score of 5.5, and there is no public exploit identified at time of analysis and no confirmed actively exploited status (CISA KEV).
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.
Deleted or deprovisioned users can retain authorization on hosts running SSSD with the LDAP access provider when ldap_access_order includes ppolicy or lockout, because a user lookup that returns zero results trips a fail-open path that reports success and caches an allow decision. A remote attacker who already holds valid account context on the SSSD-managed host (authenticated, PR:L) can exploit this after offboarding to keep reading information and make limited modifications, giving low confidentiality and integrity impact (CVSS 3.1 5.4 Medium). The flaw only affects non-default access configurations that explicitly enable ppolicy/lockout ordering, and no public exploit identified at time of analysis.
Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.
Stack-based buffer overflow in fetchmail when built with NTLM support allows a malicious or compromised mail server to trigger memory corruption by sending a crafted NTLM Type 2 challenge, potentially leading to remote code execution, authentication failure, or process termination. Exploitation requires fetchmail to be built with NTLM and configured to authenticate via NTLM against an attacker-controlled or man-in-the-middle'd server; no public exploit code or active exploitation has been identified. The flaw carries a CVSS score of 8.1 with high confidentiality, integrity, and availability impact, though reliable RCE is limited by stack-frame layout and modern memory hardening (stack canaries, ASLR, FORTIFY_SOURCE) on RHEL builds.
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
A NULL pointer dereference in libxml2's XML catalog parser allows a crash-induced denial of service when a catalog file contains a `nextCatalog` element missing its mandatory `catalog` attribute. Affected deployments are those in which an application linked against libxml2 parses an attacker-influenced catalog - Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4 carry vulnerable libxml2 packages per the supplied CPE data. The attack vector is local (AV:L) and requires user interaction (UI:R) to induce parsing of the crafted file, with no authentication required (PR:N); impact is limited to availability (C:N/I:N/A:H) and there is no public exploit identified at time of analysis. Exploitation is constrained by the need for the target to actually perform catalog parsing on untrusted input and by resilient/restartable services absorbing the crash.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in GIMP's file-xwd plugin allows a crafted XWD image file to trigger an application crash or leak partial heap memory contents into the rendered image output. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when they open a malicious XWD file; the plugin fails to cross-validate image width and bytes-per-line parameters against the allocated buffer size, permitting an out-of-bounds read. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world urgency in the low-to-moderate range.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated state-notification requests sent to a network-reachable rpc.statd service in nfs-utils cause memory allocated during callback processing to never be released, producing continuous memory growth that can degrade or crash the service and exhaust host resources. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but exploitation is not trivial: a single request is insufficient because the attacker must sustain a stream of requests long enough to exhaust memory, which is why the vector carries AC:H and the impact is availability-only (C:N/I:N/A:H, base score 5.9). Exposure is limited in practice because rpc.statd only runs when NFSv3 locking services are active and is normally bound to internal or trusted networks rather than the public internet, so firewalled or default deployments are not reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; this is a genuine but moderate-priority availability issue rather than a top-tier emergency, and affected services can be recovered by a restart.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Denial of service in libtirpc allows an authenticated remote RPC client to exhaust server memory by sending oversized wrapped-data requests to an RPC service that is configured with RPCSEC_GSS integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection. Only services explicitly running in that non-default, Kerberos-backed mode are exposed - most commonly NFS deployments on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - and the impact is availability-only (CVSS 6.5, A:H) with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it warrants medium-priority patch tracking rather than emergency response, although affected RPC services can become unstable or terminate under the resource exhaustion.
Local denial of service in the nfs-utils fsidd daemon affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4; an authenticated local user with access to the fsidd Unix domain socket can send a malformed request that omits required arguments, triggering a CWE-617 assertion failure and crashing the daemon. The service remains unavailable for filesystem identifier lookups until restarted, giving this a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Crafted ISO-2022 encoded text passed to the m17n-lib decoder can trigger an uninitialized stack memory read, potentially leaking small amounts of process memory if the application then returns or displays the decoded output to the attacker. The issue is rated low severity (CVSS 2.5, AV:L/AC:H/UI:R, unauthenticated per vector PR:N) and affects multilanguage library builds shipped across Red Hat Enterprise Linux 6 through 10, though any application embedding m17n-lib's ISO-2022 handling is in scope. No public exploit identified at time of analysis; risk is gated by the fact that the deploying application must both decode attacker-supplied ISO-2022 input and reflect the decoded result back, which is uncommon in typical installations.
Local privilege escalation and arbitrary code execution in the BusyBox tar applet (CVE-2026-108119) allow an attacker who supplies a crafted tar archive to create or replace files outside the extraction directory when the archive is extracted with elevated privileges. The flaw is a CWE-59 link-following issue in the applet's deferred symlink/hardlink creation path, with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), affecting BusyBox as shipped in Red Hat Enterprise Linux 6 and Red Hat Hardened Images. No public exploit identified at time of analysis; exploitation requires a privileged user or process to actively extract the malicious archive, and the specific archive construction plus directory-reuse timing makes this high-complexity and local-only.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.
SSSD configured with the Microsoft Entra ID identity provider fails to neutralize single quotes in lookup names before embedding them into Microsoft Graph OData queries, enabling an authenticated local attacker to inject filter syntax. This can broaden user or group searches, leading to information disclosure of unintended directory objects and a denial of service through excessive processing and cache population. The CVSS vector (AV:L/PR:L) confirms the attack is local and requires low privileges, and exploitation is only possible when the non-default Entra ID backend is enabled; no public exploit or active exploitation is reported, and no EPSS score was provided.
Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).
Denial of service in SSSD (the System Security Services Daemon) allows remote unauthenticated attackers to crash the daemon by presenting a certificate that is missing the expected Security Identifier (SID) extension during authentication or lookup operations. Only deployments explicitly configured with SID-based certificate mapping rules reach the vulnerable code path, since the certificate-to-user lookup logic dereferences the SID extension without first confirming it exists; standard installations that do not use SID-based certificate mapping are not affected. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, availability-only) and, per available intelligence, no public exploit code exists and exploitation has not been confirmed as active - no public exploit identified at time of analysis.
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Local denial of service in the SSSD Kerberos Credential Manager (KCM) responder allows an authenticated local user to exhaust host memory and make the service unresponsive by holding a persistent connection open while repeatedly storing and destroying Kerberos credentials. The flaw is a resource-lifecycle defect (CWE-772): cached objects are not released when credentials are removed, so memory grows monotonically until the responder stalls. Exploitation requires a valid local account and sustained store-then-destroy activity, yields availability impact only (CVSS 5.5, AV:L/PR:L/UI:N/A:H), and does not provide code execution or privilege escalation; no public exploit code or confirmed active exploitation was identified at time of analysis, and systems that do not use the KCM responder are not affected.
The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.
Authentication bypass in SSSD permits a user with valid credentials for an already-expired account to authenticate to the system when SSSD is configured to enforce account expiration using LDAP shadow attributes and the expiration value is stored as zero. This moderate-severity logic flaw (CVSS 5.4, CWE-193) affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4; exploitation requires the non-default shadowExpire=0 configuration and valid credentials for the expired account. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in SSSD's autofs responder allows an authenticated local unprivileged user to repeatedly request master automount map updates, triggering global cache invalidation and forcing repeated backend directory lookups, which degrades automount availability and elevates resource consumption. Affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when SSSD-backed automount maps are served from a backend directory provider such as LDAP or Active Directory. This is a moderate-priority local availability issue (CVSS 5.5) with no public exploit code identified at time of analysis.
Memory exhaustion in the SSSD autofs responder can let a local, authenticated unprivileged user deny service on affected hosts by holding an open client connection while repeatedly submitting valid requests, since per-request memory is only reclaimed when the connection closes. The flaw affects SSSD deployments on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, but the vulnerable code path is only reachable when the autofs responder is explicitly enabled in sssd.conf - a non-default configuration. Exploitation is limited to local access (AV:L/PR:L) with no impact on confidentiality or integrity, so it is correctly rated medium (CVSS 5.5); no CISA KEV entry and no public exploit code have been identified at time of analysis, and a realistic impact generally requires a shared, multi-user host where one user's resource consumption degrades service for others.
Crashing the SSSD autofs responder process via a crafted request to its UNIX socket allows a local, low-privileged attacker to cause a denial of service on affected Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 systems. The vulnerability stems from improper buffer offset calculation during request parsing, leading to an out-of-bounds read (CWE-125) that terminates the responder process; it carries a CVSS 3.3 (Low) score with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the autofs responder service must be enabled for the flaw to be exploitable.
A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
GEGL's Radiance HDR loader reads past the end of a memory-mapped image when a crafted .hdr file declares a scanline width larger than the actual data present in an uncompressed scanline, crashing the application that consumes the library - most notably GIMP, which uses GEGL for image processing. Any local user who opens such a file is affected; no authentication is required to the library, but the attacker must convince a victim to open the crafted file (UI:R), and the impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, consistent with a low-priority, local denial-of-service rather than a code-execution primitive.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
Local denial of service in the dash shell affects builds compiled without libc fnmatch, where the internal pmatch() matcher handles the '*' wildcard by unbounded recursion over candidate positions. A local attacker who can plant filenames in a directory that later gets globbed - or otherwise feed the internal matcher - can supply a short multi-star pattern such as *.*.*.*.*.tar.gz and drive excessive CPU consumption in the affected shell process. The issue requires a non-default build configuration (PR:L, AV:L, no remote reachability, no privilege escalation or data disclosure), maps to CWE-1333 (inefficient regular expression complexity) with a CVSS 3.1 score of 5.5, and there is no public exploit identified at time of analysis and no confirmed actively exploited status (CISA KEV).
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.
Deleted or deprovisioned users can retain authorization on hosts running SSSD with the LDAP access provider when ldap_access_order includes ppolicy or lockout, because a user lookup that returns zero results trips a fail-open path that reports success and caches an allow decision. A remote attacker who already holds valid account context on the SSSD-managed host (authenticated, PR:L) can exploit this after offboarding to keep reading information and make limited modifications, giving low confidentiality and integrity impact (CVSS 3.1 5.4 Medium). The flaw only affects non-default access configurations that explicitly enable ppolicy/lockout ordering, and no public exploit identified at time of analysis.
Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.
Stack-based buffer overflow in fetchmail when built with NTLM support allows a malicious or compromised mail server to trigger memory corruption by sending a crafted NTLM Type 2 challenge, potentially leading to remote code execution, authentication failure, or process termination. Exploitation requires fetchmail to be built with NTLM and configured to authenticate via NTLM against an attacker-controlled or man-in-the-middle'd server; no public exploit code or active exploitation has been identified. The flaw carries a CVSS score of 8.1 with high confidentiality, integrity, and availability impact, though reliable RCE is limited by stack-frame layout and modern memory hardening (stack canaries, ASLR, FORTIFY_SOURCE) on RHEL builds.
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
A NULL pointer dereference in libxml2's XML catalog parser allows a crash-induced denial of service when a catalog file contains a `nextCatalog` element missing its mandatory `catalog` attribute. Affected deployments are those in which an application linked against libxml2 parses an attacker-influenced catalog - Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4 carry vulnerable libxml2 packages per the supplied CPE data. The attack vector is local (AV:L) and requires user interaction (UI:R) to induce parsing of the crafted file, with no authentication required (PR:N); impact is limited to availability (C:N/I:N/A:H) and there is no public exploit identified at time of analysis. Exploitation is constrained by the need for the target to actually perform catalog parsing on untrusted input and by resilient/restartable services absorbing the crash.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Heap buffer overflow in the libtiff `tiff2pdf` utility allows local attackers to cause severe memory corruption and application crashes by supplying a crafted BigTIFF file. The root cause is an integer truncation: a 64-bit `StripByteCounts` value is silently narrowed to 32 bits, producing an undersized heap allocation that a subsequent memory copy overflows. Red Hat has issued advisory RHSA-2026:53467 and an upstream fix is available via libtiff GitLab merge request #729; no public exploit or active exploitation has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Case-insensitive username comparisons in two code paths of the CUPS scheduler - printer ACL validation and private-attribute filtering - allow an authenticated adjacent-network attacker to bypass username-based access controls in configurations that rely on those ACLs. The bypass exposes private print attributes to users who should be excluded by ACL policy. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified at time of analysis, consistent with the low CVSS base score of 3.0.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Symlink-following race condition in GLib2's g_file_replace() allows a local attacker with write access to the destination directory to redirect privileged file writes to arbitrary files. When the G_FILE_CREATE_REPLACE_DESTINATION flag is set and creation of the .goutputstream-XXXXXX temporary file fails, GLib2 unlinks the destination and then recreates it without O_EXCL (exclusive creation) or symlink-safe open semantics, opening a TOCTOU race window. An attacker who wins this race by placing a symlink at the destination path can cause any process using this code path - potentially running with elevated privileges - to overwrite files the attacker cannot directly modify. No public exploit has been identified at time of analysis.
HTTP/2 flow-control window mismanagement in libsoup (GNOME's HTTP client/server library) allows a malicious HTTP/2 server to abort a connecting client process or crash its HTTP/2 session. When the client sends a request body sourced from a non-pollable GInputStream, libsoup buffers the data before transmission; a server that then shrinks SETTINGS_INITIAL_WINDOW_SIZE causes the client to copy the full pre-buffered payload into a now-undersized DATA callback without a runtime bounds check, triggering a reachable assertion abort (CWE-617). No public exploit has been identified at time of analysis, and the high-complexity timing requirement constrains practical exploitation.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Heap metadata corruption in the popt command-line parsing library's `poptConfigFileToString` function can be triggered by a local, low-privileged attacker who supplies specially crafted configuration file content to an affected host. Successful exploitation causes the consuming process to crash, resulting in denial of service. CVSS 2.5 (Low) reflects the strictly local, high-complexity exploitation path with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) is known at time of analysis.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.
Stack-based denial of service in GIMP's Seattle FilmWorks (SFW) image plugin crashes the application when a crafted SFW file triggers an unbounded variable-length array allocation on the stack. The flaw affects all GIMP versions per the GNOME CPE string and is confirmed across Red Hat Enterprise Linux 6 through 9. An attacker who can deliver a malicious SFW file to a user can reliably crash the GIMP process with no code execution or data exposure; no public exploit has been identified at time of analysis.
Heap out-of-bounds read in GIMP's file-xwd plugin allows a crafted XWD image file to trigger an application crash or leak partial heap memory contents into the rendered image output. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when they open a malicious XWD file; the plugin fails to cross-validate image width and bytes-per-line parameters against the allocated buffer size, permitting an out-of-bounds read. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world urgency in the low-to-moderate range.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.