Red Hat Enterprise Linux 7
Monthly
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
Out-of-bounds read in Eye of GNOME (eog) when parsing a crafted PNG with malformed ICC color-profile metadata allows an attacker who convinces a user to open the image to crash the viewer and potentially expose limited memory contents. Affected deployments are GNOME desktop systems, including the Red Hat Enterprise Linux 6 through 9 package scope identified in CPE data; headless servers without eog installed are not exposed. Exploitation requires user interaction via a local vector, and no public exploit or CISA KEV confirmation was identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
dnsmasq's DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option when the server processes a single DHCPv6 packet from an attacker on the same local link. The over-read byte is neither returned to the client nor logged, and no crash or confirmed information disclosure has been demonstrated; the independent assessment scores confidentiality, integrity, and availability impact as none, so real-world risk is low despite the genuine memory-safety defect. No CISA KEV entry or public exploit code was identified at time of analysis.
DHCP lease metadata disclosure in dnsmasq (CVE-2026-93010) occurs when the DHCP leasequery feature has been switched on without an allow-list of permitted query sources, letting any host on the local network pull lease records - assigned IP addresses, MAC addresses, hostnames and related lease metadata. The package is shipped across Red Hat Enterprise Linux 6 through 10 and is bundled into Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform builds, but the vulnerable feature is off unless an administrator explicitly enables it. Severity is capped at a confidentiality-only leak (CVSS 4.3, adjacent-network attack vector), and no public exploit code or active exploitation has been identified at time of analysis.
TFTP file substitution in dnsmasq allows an attacker on the local network to make a later client receive stale, previously cached transfer data instead of the file it requested; in PXE network-boot deployments this can substitute attacker-chosen boot content for a victim machine, giving both confidentiality and integrity impact. The flaw only exists when dnsmasq is running with its TFTP server feature enabled (a non-default configuration used for network boot), requires adjacent-network access (AV:A) with no authentication (PR:N) and no user interaction (UI:N), but is rated high complexity (AC:H) because the attacker cannot control when another client will request the same file and pick up the cached response. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the vendor-reported CVSS 3.1 score is 6.8, making this a moderate, situational issue rather than an emergency; Red Hat tracks it for remediation within the current monthly cycle.
Denial of service against dnsmasq's TCP DNS service: remote attackers can occupy the entire small fixed pool of TCP child processes by holding idle connections open to port 53, which blocks new TCP DNS queries and any DNSSEC validation that depends on TCP fallback. The flaw is packaged in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform 13 (Queens) and 18.0, so any of those deployments exposing TCP/53 to untrusted networks is in scope. Impact is confined to availability and is time-bounded rather than permanent - UDP resolution keeps working and occupied slots are released after a fixed lifetime - and no public exploit identified at time of analysis.
dnsmasq builds that include the DNSSEC validator and have validation enabled at runtime can write a few bytes past an internal domain-name buffer when converting names to and from DNS wire format, corrupting adjacent heap metadata. Only deployments where DNSSEC support was compiled in and DNSSEC validation is switched on are exposed; the default dnsmasq build omits DNSSEC entirely, and exploitation further requires an attacker to make the resolver validate a crafted DNSSEC response, for example through a spoofed or attacker-controlled answer for a signed name. Rated CVSS 5.3 (integrity-only, low impact) and no public exploit identified at time of analysis; the priority signal is this_month, not immediate action.
A DNS cache-poisoning flaw in dnsmasq (CWE-345, insufficient verification of data authenticity) lets a malicious or compromised upstream resolver inject cached records for names outside its authoritative zone when dnsmasq follows a CNAME in a response. Only split-DNS deployments that forward specific domains to a designated upstream are realistically exposed, since the attacker must already occupy that trusted upstream position; standard single-forwarder or root-hint setups are far less affected. Impact is integrity-only (attacker-chosen addresses returned to later clients), rated CVSS 6.8 with AC:H, and no public exploit code or KEV entry was identified at time of analysis, so priority follows the vendor's this-month cadence rather than emergency response.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
gssproxy can be persistently crashed by any local user who can reach its Unix domain socket: a GSSX_INIT_SEC_CONTEXT request that omits the target_name field triggers a NULL pointer dereference in the daemon. The issue affects gssproxy deployments on Red Hat Enterprise Linux 7, 8, 9, and 10 and is listed for Red Hat OpenShift Container Platform 4; because gssproxy does not automatically restart, Kerberized NFS and IdM services that depend on it can be disrupted until an administrator intervenes. No public exploit identified at time of analysis.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the GStreamer ASF demuxer (gst-plugins-ugly), rated CVSS 6.5, allows a crafted ASF, WMV, or WMA file to drive an oversized heap allocation because an attacker-controlled Simple Index entry count is not bounded by the object's actual payload. The issue affects gst-plugins-ugly packages in Red Hat Enterprise Linux 7, 8, 9, and 10; exploitation requires a victim to open or preview the malicious media file, with an unauthenticated network vector and user interaction required, and impact is limited to availability loss with no code execution or data exposure. No public exploit identified at time of analysis.
Local privilege escalation in Red Hat rhc's rhc-canonical-facts.service lets an attacker who has already compromised the privileged yggdrasil service account pre-plant a symbolic link so the root-run unit follows it and changes ownership of an arbitrary file, enabling escalation to root. The flaw is CWE-59 link following and affects rhc installations on Red Hat Enterprise Linux 7, 8, 9, and 10 per CPE data; exploitation is local-only and requires high privileges (CVSS PR:H), so risk is confined to systems where the yggdrasil account is already reachable. No public exploit code was identified in the provided sources at time of analysis, and no CISA KEV or EPSS signal was supplied.
Repeated state-notification requests sent to a network-reachable rpc.statd service in nfs-utils cause memory allocated during callback processing to never be released, producing continuous memory growth that can degrade or crash the service and exhaust host resources. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but exploitation is not trivial: a single request is insufficient because the attacker must sustain a stream of requests long enough to exhaust memory, which is why the vector carries AC:H and the impact is availability-only (C:N/I:N/A:H, base score 5.9). Exposure is limited in practice because rpc.statd only runs when NFSv3 locking services are active and is normally bound to internal or trusted networks rather than the public internet, so firewalled or default deployments are not reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; this is a genuine but moderate-priority availability issue rather than a top-tier emergency, and affected services can be recovered by a restart.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Denial of service in libtirpc allows an authenticated remote RPC client to exhaust server memory by sending oversized wrapped-data requests to an RPC service that is configured with RPCSEC_GSS integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection. Only services explicitly running in that non-default, Kerberos-backed mode are exposed - most commonly NFS deployments on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - and the impact is availability-only (CVSS 6.5, A:H) with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it warrants medium-priority patch tracking rather than emergency response, although affected RPC services can become unstable or terminate under the resource exhaustion.
Local denial of service in the nfs-utils fsidd daemon affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4; an authenticated local user with access to the fsidd Unix domain socket can send a malformed request that omits required arguments, triggering a CWE-617 assertion failure and crashing the daemon. The service remains unavailable for filesystem identifier lookups until restarted, giving this a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis.
Argument injection in libblockdev's NTFS and VFAT label-setting routines lets a local, unprivileged user smuggle command-line flags into the ntfslabel and fatlabel utilities through a filesystem label that begins with a dash. The vulnerable paths (bd_fs_ntfs_set_label() and bd_fs_vfat_set_label()) are reachable without administrator authentication via the udisks2 Filesystem.SetLabel() D-Bus method, but exploitation is strictly local and the assessed impact is low integrity only - no confidentiality or availability loss and no privilege escalation. No public exploit code has been identified at time of analysis, and the low CVSS score (3.3, AV:L/PR:L/I:L) reflects the limited blast radius rather than an unexplored attack surface.
Improper boundary validation of metadata slot values in luksmeta allows an attacker who can supply or modify a LUKS disk header to redirect wipe or load operations outside the intended metadata area, overwriting or zeroing encrypted payload data and causing persistent data loss and corrupted storage. The attack is confined to a local vector and requires high privileges - root-level write access to the raw block device, or inducing an administrator to process an attacker-supplied untrusted disk image whose header carries out-of-range slot values together with valid checksums. The impact is limited to integrity and availability, with no information disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the moderate CVSS of 6.0 reflects the substantial privilege barrier rather than the severity of the data-loss outcome.
Local authenticated attackers can retrieve LUKS disk-encryption passphrases from hosts using the Clevis PKCS#11 pin because the clevis-pkcs11-afunix-socket-unlock daemon writes passphrases in plaintext to a world-readable log file. This affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4 deployments where this non-default disk-unlock configuration is in use. No public exploit code has been identified at time of analysis; exploitation requires an existing low-privileged local account and prior logging of a LUKS unlock passphrase.
An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.
Local attackers can exploit improperly secured AF_UNIX sockets in the clevis PKCS#11 pin to inject arbitrary device/key pairs or intercept LUKS passphrases, potentially gaining unauthorized access to encrypted disks. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. Exploitation requires an authenticated local user and a permissive process umask; no public exploit code or active exploitation has been identified, and the issue is rated modest priority due to the local-only attack vector and dependency on non-default umask settings.
Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.
Crafted ISO-2022 encoded text passed to the m17n-lib decoder can trigger an uninitialized stack memory read, potentially leaking small amounts of process memory if the application then returns or displays the decoded output to the attacker. The issue is rated low severity (CVSS 2.5, AV:L/AC:H/UI:R, unauthenticated per vector PR:N) and affects multilanguage library builds shipped across Red Hat Enterprise Linux 6 through 10, though any application embedding m17n-lib's ISO-2022 handling is in scope. No public exploit identified at time of analysis; risk is gated by the fact that the deploying application must both decode attacker-supplied ISO-2022 input and reflect the decoded result back, which is uncommon in typical installations.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.
Data corruption in luksmeta allows a local attacker who already holds administrative privileges to damage or destroy metadata and encrypted payload data stored on a Linux Unified Key Setup (LUKS) device when a new metadata entry is saved. Because faulty free-space boundary calculations and flawed overlap detection can let new records be written past the available area or on top of existing ones, integrity is fully compromised though confidentiality is not (CVSS 5.1, AV:L/AC:L/PR:H/UI:N/C:N/I:H/A:L), and affected volumes may become inaccessible. Exploitation requires local host access with privileges sufficient to run luksmeta and write to the device; there is no remote or unauthenticated vector, no public exploit identified at time of analysis, and no confirmed active exploitation (not in CISA KEV), so impact is realistically limited to accidental or deliberate corruption by a privileged operator. The issue affects luksmeta as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10, plus Red Hat OpenShift Container Platform 4 through the underlying RHCOS userland.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.
SSSD configured with the Microsoft Entra ID identity provider fails to neutralize single quotes in lookup names before embedding them into Microsoft Graph OData queries, enabling an authenticated local attacker to inject filter syntax. This can broaden user or group searches, leading to information disclosure of unintended directory objects and a denial of service through excessive processing and cache population. The CVSS vector (AV:L/PR:L) confirms the attack is local and requires low privileges, and exploitation is only possible when the non-default Entra ID backend is enabled; no public exploit or active exploitation is reported, and no EPSS score was provided.
Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).
Denial of service in SSSD (the System Security Services Daemon) allows remote unauthenticated attackers to crash the daemon by presenting a certificate that is missing the expected Security Identifier (SID) extension during authentication or lookup operations. Only deployments explicitly configured with SID-based certificate mapping rules reach the vulnerable code path, since the certificate-to-user lookup logic dereferences the SID extension without first confirming it exists; standard installations that do not use SID-based certificate mapping are not affected. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, availability-only) and, per available intelligence, no public exploit code exists and exploitation has not been confirmed as active - no public exploit identified at time of analysis.
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Local denial of service in the SSSD Kerberos Credential Manager (KCM) responder allows an authenticated local user to exhaust host memory and make the service unresponsive by holding a persistent connection open while repeatedly storing and destroying Kerberos credentials. The flaw is a resource-lifecycle defect (CWE-772): cached objects are not released when credentials are removed, so memory grows monotonically until the responder stalls. Exploitation requires a valid local account and sustained store-then-destroy activity, yields availability impact only (CVSS 5.5, AV:L/PR:L/UI:N/A:H), and does not provide code execution or privilege escalation; no public exploit code or confirmed active exploitation was identified at time of analysis, and systems that do not use the KCM responder are not affected.
The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.
Authentication bypass in SSSD permits a user with valid credentials for an already-expired account to authenticate to the system when SSSD is configured to enforce account expiration using LDAP shadow attributes and the expiration value is stored as zero. This moderate-severity logic flaw (CVSS 5.4, CWE-193) affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4; exploitation requires the non-default shadowExpire=0 configuration and valid credentials for the expired account. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in SSSD's autofs responder allows an authenticated local unprivileged user to repeatedly request master automount map updates, triggering global cache invalidation and forcing repeated backend directory lookups, which degrades automount availability and elevates resource consumption. Affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when SSSD-backed automount maps are served from a backend directory provider such as LDAP or Active Directory. This is a moderate-priority local availability issue (CVSS 5.5) with no public exploit code identified at time of analysis.
Memory exhaustion in the SSSD autofs responder can let a local, authenticated unprivileged user deny service on affected hosts by holding an open client connection while repeatedly submitting valid requests, since per-request memory is only reclaimed when the connection closes. The flaw affects SSSD deployments on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, but the vulnerable code path is only reachable when the autofs responder is explicitly enabled in sssd.conf - a non-default configuration. Exploitation is limited to local access (AV:L/PR:L) with no impact on confidentiality or integrity, so it is correctly rated medium (CVSS 5.5); no CISA KEV entry and no public exploit code have been identified at time of analysis, and a realistic impact generally requires a shared, multi-user host where one user's resource consumption degrades service for others.
Crashing the SSSD autofs responder process via a crafted request to its UNIX socket allows a local, low-privileged attacker to cause a denial of service on affected Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 systems. The vulnerability stems from improper buffer offset calculation during request parsing, leading to an out-of-bounds read (CWE-125) that terminates the responder process; it carries a CVSS 3.3 (Low) score with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the autofs responder service must be enabled for the flaw to be exploitable.
A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
GEGL's Radiance HDR loader reads past the end of a memory-mapped image when a crafted .hdr file declares a scanline width larger than the actual data present in an uncompressed scanline, crashing the application that consumes the library - most notably GIMP, which uses GEGL for image processing. Any local user who opens such a file is affected; no authentication is required to the library, but the attacker must convince a victim to open the crafted file (UI:R), and the impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, consistent with a low-priority, local denial-of-service rather than a code-execution primitive.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
Out-of-bounds read in Eye of GNOME (eog) when parsing a crafted PNG with malformed ICC color-profile metadata allows an attacker who convinces a user to open the image to crash the viewer and potentially expose limited memory contents. Affected deployments are GNOME desktop systems, including the Red Hat Enterprise Linux 6 through 9 package scope identified in CPE data; headless servers without eog installed are not exposed. Exploitation requires user interaction via a local vector, and no public exploit or CISA KEV confirmation was identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
dnsmasq's DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option when the server processes a single DHCPv6 packet from an attacker on the same local link. The over-read byte is neither returned to the client nor logged, and no crash or confirmed information disclosure has been demonstrated; the independent assessment scores confidentiality, integrity, and availability impact as none, so real-world risk is low despite the genuine memory-safety defect. No CISA KEV entry or public exploit code was identified at time of analysis.
DHCP lease metadata disclosure in dnsmasq (CVE-2026-93010) occurs when the DHCP leasequery feature has been switched on without an allow-list of permitted query sources, letting any host on the local network pull lease records - assigned IP addresses, MAC addresses, hostnames and related lease metadata. The package is shipped across Red Hat Enterprise Linux 6 through 10 and is bundled into Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform builds, but the vulnerable feature is off unless an administrator explicitly enables it. Severity is capped at a confidentiality-only leak (CVSS 4.3, adjacent-network attack vector), and no public exploit code or active exploitation has been identified at time of analysis.
TFTP file substitution in dnsmasq allows an attacker on the local network to make a later client receive stale, previously cached transfer data instead of the file it requested; in PXE network-boot deployments this can substitute attacker-chosen boot content for a victim machine, giving both confidentiality and integrity impact. The flaw only exists when dnsmasq is running with its TFTP server feature enabled (a non-default configuration used for network boot), requires adjacent-network access (AV:A) with no authentication (PR:N) and no user interaction (UI:N), but is rated high complexity (AC:H) because the attacker cannot control when another client will request the same file and pick up the cached response. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the vendor-reported CVSS 3.1 score is 6.8, making this a moderate, situational issue rather than an emergency; Red Hat tracks it for remediation within the current monthly cycle.
Denial of service against dnsmasq's TCP DNS service: remote attackers can occupy the entire small fixed pool of TCP child processes by holding idle connections open to port 53, which blocks new TCP DNS queries and any DNSSEC validation that depends on TCP fallback. The flaw is packaged in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, Ceph Storage 9 and OpenStack Platform 13 (Queens) and 18.0, so any of those deployments exposing TCP/53 to untrusted networks is in scope. Impact is confined to availability and is time-bounded rather than permanent - UDP resolution keeps working and occupied slots are released after a fixed lifetime - and no public exploit identified at time of analysis.
dnsmasq builds that include the DNSSEC validator and have validation enabled at runtime can write a few bytes past an internal domain-name buffer when converting names to and from DNS wire format, corrupting adjacent heap metadata. Only deployments where DNSSEC support was compiled in and DNSSEC validation is switched on are exposed; the default dnsmasq build omits DNSSEC entirely, and exploitation further requires an attacker to make the resolver validate a crafted DNSSEC response, for example through a spoofed or attacker-controlled answer for a signed name. Rated CVSS 5.3 (integrity-only, low impact) and no public exploit identified at time of analysis; the priority signal is this_month, not immediate action.
A DNS cache-poisoning flaw in dnsmasq (CWE-345, insufficient verification of data authenticity) lets a malicious or compromised upstream resolver inject cached records for names outside its authoritative zone when dnsmasq follows a CNAME in a response. Only split-DNS deployments that forward specific domains to a designated upstream are realistically exposed, since the attacker must already occupy that trusted upstream position; standard single-forwarder or root-hint setups are far less affected. Impact is integrity-only (attacker-chosen addresses returned to later clients), rated CVSS 6.8 with AC:H, and no public exploit code or KEV entry was identified at time of analysis, so priority follows the vendor's this-month cadence rather than emergency response.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
gssproxy can be persistently crashed by any local user who can reach its Unix domain socket: a GSSX_INIT_SEC_CONTEXT request that omits the target_name field triggers a NULL pointer dereference in the daemon. The issue affects gssproxy deployments on Red Hat Enterprise Linux 7, 8, 9, and 10 and is listed for Red Hat OpenShift Container Platform 4; because gssproxy does not automatically restart, Kerberized NFS and IdM services that depend on it can be disrupted until an administrator intervenes. No public exploit identified at time of analysis.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the GStreamer ASF demuxer (gst-plugins-ugly), rated CVSS 6.5, allows a crafted ASF, WMV, or WMA file to drive an oversized heap allocation because an attacker-controlled Simple Index entry count is not bounded by the object's actual payload. The issue affects gst-plugins-ugly packages in Red Hat Enterprise Linux 7, 8, 9, and 10; exploitation requires a victim to open or preview the malicious media file, with an unauthenticated network vector and user interaction required, and impact is limited to availability loss with no code execution or data exposure. No public exploit identified at time of analysis.
Local privilege escalation in Red Hat rhc's rhc-canonical-facts.service lets an attacker who has already compromised the privileged yggdrasil service account pre-plant a symbolic link so the root-run unit follows it and changes ownership of an arbitrary file, enabling escalation to root. The flaw is CWE-59 link following and affects rhc installations on Red Hat Enterprise Linux 7, 8, 9, and 10 per CPE data; exploitation is local-only and requires high privileges (CVSS PR:H), so risk is confined to systems where the yggdrasil account is already reachable. No public exploit code was identified in the provided sources at time of analysis, and no CISA KEV or EPSS signal was supplied.
Repeated state-notification requests sent to a network-reachable rpc.statd service in nfs-utils cause memory allocated during callback processing to never be released, producing continuous memory growth that can degrade or crash the service and exhaust host resources. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but exploitation is not trivial: a single request is insufficient because the attacker must sustain a stream of requests long enough to exhaust memory, which is why the vector carries AC:H and the impact is availability-only (C:N/I:N/A:H, base score 5.9). Exposure is limited in practice because rpc.statd only runs when NFSv3 locking services are active and is normally bound to internal or trusted networks rather than the public internet, so firewalled or default deployments are not reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; this is a genuine but moderate-priority availability issue rather than a top-tier emergency, and affected services can be recovered by a restart.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
Denial of service and limited memory disclosure in GIMP's Bohemia Interactive (PAA) texture importer, triggered when a user opens or previews a specially crafted .paa file through the affected plug-in. An integer overflow in the image-dimension calculation during decompression causes an undersized heap buffer to be allocated, and the subsequent out-of-bounds read crashes the plug-in process and may expose fragments of heap memory (CVSS 3.1 base 6.1, AV:L/PR:N/UI:R, C:L/A:H). The attack requires the victim to deliberately load the malicious file locally, so there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - this is assessed as a moderate-severity, low-priority issue in practice.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Denial of service in libtirpc allows an authenticated remote RPC client to exhaust server memory by sending oversized wrapped-data requests to an RPC service that is configured with RPCSEC_GSS integrity (rpc_gss_svc_integrity) or privacy (rpc_gss_svc_privacy) protection. Only services explicitly running in that non-default, Kerberos-backed mode are exposed - most commonly NFS deployments on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 - and the impact is availability-only (CVSS 6.5, A:H) with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it warrants medium-priority patch tracking rather than emergency response, although affected RPC services can become unstable or terminate under the resource exhaustion.
Local denial of service in the nfs-utils fsidd daemon affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4; an authenticated local user with access to the fsidd Unix domain socket can send a malformed request that omits required arguments, triggering a CWE-617 assertion failure and crashing the daemon. The service remains unavailable for filesystem identifier lookups until restarted, giving this a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis.
Argument injection in libblockdev's NTFS and VFAT label-setting routines lets a local, unprivileged user smuggle command-line flags into the ntfslabel and fatlabel utilities through a filesystem label that begins with a dash. The vulnerable paths (bd_fs_ntfs_set_label() and bd_fs_vfat_set_label()) are reachable without administrator authentication via the udisks2 Filesystem.SetLabel() D-Bus method, but exploitation is strictly local and the assessed impact is low integrity only - no confidentiality or availability loss and no privilege escalation. No public exploit code has been identified at time of analysis, and the low CVSS score (3.3, AV:L/PR:L/I:L) reflects the limited blast radius rather than an unexplored attack surface.
Improper boundary validation of metadata slot values in luksmeta allows an attacker who can supply or modify a LUKS disk header to redirect wipe or load operations outside the intended metadata area, overwriting or zeroing encrypted payload data and causing persistent data loss and corrupted storage. The attack is confined to a local vector and requires high privileges - root-level write access to the raw block device, or inducing an administrator to process an attacker-supplied untrusted disk image whose header carries out-of-range slot values together with valid checksums. The impact is limited to integrity and availability, with no information disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the moderate CVSS of 6.0 reflects the substantial privilege barrier rather than the severity of the data-loss outcome.
Local authenticated attackers can retrieve LUKS disk-encryption passphrases from hosts using the Clevis PKCS#11 pin because the clevis-pkcs11-afunix-socket-unlock daemon writes passphrases in plaintext to a world-readable log file. This affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4 deployments where this non-default disk-unlock configuration is in use. No public exploit code has been identified at time of analysis; exploitation requires an existing low-privileged local account and prior logging of a LUKS unlock passphrase.
An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.
Local attackers can exploit improperly secured AF_UNIX sockets in the clevis PKCS#11 pin to inject arbitrary device/key pairs or intercept LUKS passphrases, potentially gaining unauthorized access to encrypted disks. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. Exploitation requires an authenticated local user and a permissive process umask; no public exploit code or active exploitation has been identified, and the issue is rated modest priority due to the local-only attack vector and dependency on non-default umask settings.
Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.
An out-of-bounds read in BlueZ's btmon Bluetooth monitoring utility, as packaged in Red Hat Enterprise Linux 6 through 10, allows an attacker to crash the tool by getting a user to open a crafted btsnoop capture file containing an HCI Return Link Keys event that advertises more link keys than the packet actually contains. The flaw is local-access and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - the victim must deliberately load the malicious capture into btmon - which sharply limits real-world exposure given btmon is a diagnostic tool rarely pointed at untrusted input. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical outcome is a denial of service against the monitoring utility rather than any network- or privilege-escalation impact.
Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.
Crafted ISO-2022 encoded text passed to the m17n-lib decoder can trigger an uninitialized stack memory read, potentially leaking small amounts of process memory if the application then returns or displays the decoded output to the attacker. The issue is rated low severity (CVSS 2.5, AV:L/AC:H/UI:R, unauthenticated per vector PR:N) and affects multilanguage library builds shipped across Red Hat Enterprise Linux 6 through 10, though any application embedding m17n-lib's ISO-2022 handling is in scope. No public exploit identified at time of analysis; risk is gated by the fact that the deploying application must both decode attacker-supplied ISO-2022 input and reflect the decoded result back, which is uncommon in typical installations.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.
Data corruption in luksmeta allows a local attacker who already holds administrative privileges to damage or destroy metadata and encrypted payload data stored on a Linux Unified Key Setup (LUKS) device when a new metadata entry is saved. Because faulty free-space boundary calculations and flawed overlap detection can let new records be written past the available area or on top of existing ones, integrity is fully compromised though confidentiality is not (CVSS 5.1, AV:L/AC:L/PR:H/UI:N/C:N/I:H/A:L), and affected volumes may become inaccessible. Exploitation requires local host access with privileges sufficient to run luksmeta and write to the device; there is no remote or unauthenticated vector, no public exploit identified at time of analysis, and no confirmed active exploitation (not in CISA KEV), so impact is realistically limited to accidental or deliberate corruption by a privileged operator. The issue affects luksmeta as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10, plus Red Hat OpenShift Container Platform 4 through the underlying RHCOS userland.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A local, authenticated user on hosts running sssd (System Security Services Daemon) can stall the daemon's responder service by opening and holding a large number of concurrent connections to a responder socket while continuing to queue new connection attempts, driving the responder past its file-descriptor limit into an unthrottled retry loop. The result is a denial-of-service condition with high CPU consumption that blocks legitimate identity and authentication lookups (NSS/PAM) for other users. Exploitation requires local access and is rated high complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7), so realistic exposure is concentrated on shared or multi-user systems rather than single-administrator hosts; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.
A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.
SSSD configured with the Microsoft Entra ID identity provider fails to neutralize single quotes in lookup names before embedding them into Microsoft Graph OData queries, enabling an authenticated local attacker to inject filter syntax. This can broaden user or group searches, leading to information disclosure of unintended directory objects and a denial of service through excessive processing and cache population. The CVSS vector (AV:L/PR:L) confirms the attack is local and requires low privileges, and exploitation is only possible when the non-default Entra ID backend is enabled; no public exploit or active exploitation is reported, and no EPSS score was provided.
Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).
Denial of service in SSSD (the System Security Services Daemon) allows remote unauthenticated attackers to crash the daemon by presenting a certificate that is missing the expected Security Identifier (SID) extension during authentication or lookup operations. Only deployments explicitly configured with SID-based certificate mapping rules reach the vulnerable code path, since the certificate-to-user lookup logic dereferences the SID extension without first confirming it exists; standard installations that do not use SID-based certificate mapping are not affected. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, availability-only) and, per available intelligence, no public exploit code exists and exploitation has not been confirmed as active - no public exploit identified at time of analysis.
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.
SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Local denial of service in the SSSD Kerberos Credential Manager (KCM) responder allows an authenticated local user to exhaust host memory and make the service unresponsive by holding a persistent connection open while repeatedly storing and destroying Kerberos credentials. The flaw is a resource-lifecycle defect (CWE-772): cached objects are not released when credentials are removed, so memory grows monotonically until the responder stalls. Exploitation requires a valid local account and sustained store-then-destroy activity, yields availability impact only (CVSS 5.5, AV:L/PR:L/UI:N/A:H), and does not provide code execution or privilege escalation; no public exploit code or confirmed active exploitation was identified at time of analysis, and systems that do not use the KCM responder are not affected.
The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.
Authentication bypass in SSSD permits a user with valid credentials for an already-expired account to authenticate to the system when SSSD is configured to enforce account expiration using LDAP shadow attributes and the expiration value is stored as zero. This moderate-severity logic flaw (CVSS 5.4, CWE-193) affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4; exploitation requires the non-default shadowExpire=0 configuration and valid credentials for the expired account. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in SSSD's autofs responder allows an authenticated local unprivileged user to repeatedly request master automount map updates, triggering global cache invalidation and forcing repeated backend directory lookups, which degrades automount availability and elevates resource consumption. Affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when SSSD-backed automount maps are served from a backend directory provider such as LDAP or Active Directory. This is a moderate-priority local availability issue (CVSS 5.5) with no public exploit code identified at time of analysis.
Memory exhaustion in the SSSD autofs responder can let a local, authenticated unprivileged user deny service on affected hosts by holding an open client connection while repeatedly submitting valid requests, since per-request memory is only reclaimed when the connection closes. The flaw affects SSSD deployments on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, but the vulnerable code path is only reachable when the autofs responder is explicitly enabled in sssd.conf - a non-default configuration. Exploitation is limited to local access (AV:L/PR:L) with no impact on confidentiality or integrity, so it is correctly rated medium (CVSS 5.5); no CISA KEV entry and no public exploit code have been identified at time of analysis, and a realistic impact generally requires a shared, multi-user host where one user's resource consumption degrades service for others.
Crashing the SSSD autofs responder process via a crafted request to its UNIX socket allows a local, low-privileged attacker to cause a denial of service on affected Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 systems. The vulnerability stems from improper buffer offset calculation during request parsing, leading to an out-of-bounds read (CWE-125) that terminates the responder process; it carries a CVSS 3.3 (Low) score with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the autofs responder service must be enabled for the flaw to be exploitable.
A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
GEGL's Radiance HDR loader reads past the end of a memory-mapped image when a crafted .hdr file declares a scanline width larger than the actual data present in an uncompressed scanline, crashing the application that consumes the library - most notably GIMP, which uses GEGL for image processing. Any local user who opens such a file is affected; no authentication is required to the library, but the attacker must convince a victim to open the crafted file (UI:R), and the impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, consistent with a low-priority, local denial-of-service rather than a code-execution primitive.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.