Red Hat Enterprise Linux 7
Monthly
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
Integer underflow in GStreamer's avidemux element allows a remote unauthenticated attacker to trigger heap out-of-bounds read and write, heap memory disclosure, and application crash by delivering a crafted AVI file containing a malformed FUJIFILM strd chunk. The gst_avi_demux_parse_strd() function decrements its remaining-length counter by fixed offsets without bounds checking, causing unsigned integer wraparound for payloads of exactly 106 or 107 bytes. Because avidemux is auto-plugged by GStreamer's high-level components (playbin, decodebin, gst-discoverer), any application that opens or previews a media file - including GNOME Files, Nautilus, Totem, and many others - can trigger the vulnerability without user awareness. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available in gst-plugins-good 1.28.6.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
NULL pointer dereference in the shim application's dp.c library exposes Red Hat Enterprise Linux 7, 8, and 9 systems using UEFI Secure Boot to a local denial-of-service condition. An attacker with high local privileges and the ability to interact with the shim boot path can trigger the missing NULL pointer check, potentially disrupting the boot process. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.9 reflects the constrained attack prerequisites, though the changed scope (S:C) signals that the impact crosses from the shim component into the broader boot environment.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Signed integer overflow in GIMP's file-fli plugin causes application crashes when processing maliciously crafted FLI animation files, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where incorrect multiplication of image width and height during buffer size calculation can overflow a signed integer, producing an invalid allocation. No public exploit code or active exploitation has been identified; impact is strictly limited to availability, with no confidentiality or integrity consequences.
Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Directory Server 11-13) allows unauthenticated remote attackers - when the default anonymous access setting is active - to manipulate replication metadata, purge changelog records, and abort administrator-initiated cleanup tasks. The affected operations are replication-maintenance primitives that bypass the authorization layer entirely (CWE-862), meaning no account or session is required under default configuration. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the network-accessible, zero-authentication attack surface in a widely deployed enterprise directory server makes this a notable availability and integrity risk.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in `print_hw_addr()` and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SSRF bypass in stunnel 5.79 and earlier allows authenticated SOCKS proxy clients to circumvent intended localhost access restrictions by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) in proxy requests. Exploitation reaches loopback-bound services on the stunnel host - services deliberately isolated from external network access - potentially exposing internal APIs, administrative interfaces, or other localhost-only endpoints. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
GNU tar's --one-top-level extraction mode fails to confine hardlink targets to the designated top-level directory, allowing a crafted archive to plant hardlinks that escape the intended extraction boundary. When combined with a preexisting symbolic link already present under the working directory, an attacker who can induce a victim to extract a malicious archive may read or write files outside the intended extraction scope on systems running affected RHEL versions (6 through 10) and Red Hat Hardened Images. No public exploit has been identified at time of analysis, and exploitation requires both user interaction and a specific environmental pre-condition, keeping real-world risk moderate despite GNU tar's ubiquitous deployment.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Timing side-channel exposure in Red Hat Directory Server's PBKDF2-SHA256 password verification allows a remote unauthenticated attacker to send repeated LDAP bind requests and statistically infer partial hash information by measuring response-time differences caused by non-constant-time memcmp() comparisons. Affected deployments span Red Hat Directory Server 11 through 13 and the 389-ds-base package shipped across RHEL 6 through 10. No public exploit identified at time of analysis, and practical exploitation is acknowledged to be extremely difficult due to the computational overhead inherent in PBKDF2 key stretching, which substantially degrades the timing signal.
Attribute encryption in the 389-ds-base LDBM backend exposes a cryptographic design flaw affecting Red Hat Directory Server 11, 12, and 13 across all supported RHEL releases (6 through 10). The LDBM backend applies a static, hardcoded initialization vector (IV) for both AES-CBC and 3DES-CBC encryption of directory attribute values, meaning that two entries storing identical plaintext for an encrypted attribute will always produce identical ciphertext blocks - a classic ciphertext equality oracle. An attacker with privileged filesystem-level read access to the LDBM database files can exploit this to determine whether any two encrypted attribute values are identical, leaking relational information about the directory without recovering plaintext. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to corrupt heap memory and likely crash the LDAP service. The flaw triggers when the server processes an LDAP operation - such as a search request - whose base DN contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), causing an out-of-bounds write during RDN attribute-value pair sorting. Per the confirmed CVSS vector (PR:N), no authentication is required; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in GIMP's PlayStation TIM image loader crashes the plug-in when processing a maliciously crafted TIM file, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where the TIM loader multiplies two 16-bit unsigned short values (num_colors × num_cluts) without bounds checking, producing a 32-bit overflow that corrupts CLUT size calculation and triggers an abort. No public exploit code has been identified at time of analysis, and exploitation requires user interaction to open a crafted file, limiting real-world impact to targeted social engineering scenarios.
Two off-by-one errors in FreeIPA's ipa-otpd daemon expose RHEL 6 through 10 deployments configured with an external OAuth2/OIDC Identity Provider to out-of-bounds memory access during the device authorization flow. An attacker who controls or can man-in-the-middle the configured IdP endpoint can serve an oversized authorization response, triggering CWE-787 writes or reads one byte past a fixed-size buffer boundary. The most probable outcome is denial of service of the ipa-otpd daemon; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Double-free memory corruption in GIMP's PSP file format parser exposes local users to denial of service and potential arbitrary code execution when opening a specially crafted Paint Shop Pro image file. The flaw in read_layer_block() allows heap memory corruption that reliably crashes GIMP and, in a more sophisticated exploitation scenario, could enable arbitrary code execution with the privileges of the victim user. No public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, though upstream tagging of the issue as RCE-capable warrants patching in environments where GIMP users may open untrusted image files.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Stack exhaustion in p11-kit's RPC server crashes the daemon and any dependent cryptographic services on affected Red Hat systems. The vulnerability exists in the PKCS#11 RPC message parsing layer, where two attribute-handling functions form a mutually-recursive call chain with no depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes - allowing any local user or process with socket access to crash the server by sending a single crafted request. No public exploit or active exploitation has been identified at time of analysis, and impact is limited to availability (denial of service) with no confidentiality or integrity consequence.
Heap use-after-free read in libblkid (util-linux) enables unauthenticated local attackers to crash udisks or leak root-process heap data by presenting a crafted block device image during nested partition probing. BSD, Minix, Solaris x86, and UnixWare partition table parsers cache raw pointers into a dynamically allocated partition array; when subsequent partition additions trigger array reallocation, those pointers become stale and dereference freed memory. Because udev and udisks invoke libblkid automatically as root on block-device hot-plug events, USB insertion alone is sufficient to trigger the flaw without any user interaction or authentication. No public exploit identified at time of analysis.
Path traversal in spice-vdagent enables a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system during file transfer operations. Affecting Red Hat Enterprise Linux versions 6 through 10, the flaw stems from unsanitized filenames supplied by the SPICE host before use by the vdagent process, allowing writes at the privilege level of the logged-in guest user. No public exploit is identified at time of analysis, and exploitation requires prior control of the SPICE host - a high-privilege precondition that substantially constrains realistic risk despite the high integrity impact.
Integer overflow in spice-vdagent's message parsing allows a malicious or compromised SPICE host to crash the guest VM's vdagent daemon by delivering a specially crafted message that triggers a downstream heap buffer overflow. Affected deployments span spice-vdagent as packaged in Red Hat Enterprise Linux 6 through 10, where the daemon runs inside guests handling host-to-guest SPICE protocol communications. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is structurally constrained by the requirement that the attacking SPICE host itself be untrusted or already compromised prior to the attack.
Heap out-of-bounds read in GStreamer's gst-plugins-bad H.264 parser allows an attacker to crash a media application or leak a single byte of heap memory by tricking a victim into opening a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units. Affected systems span Red Hat Enterprise Linux versions 6 through 10 where gst-plugins-bad is installed. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the narrow 1-byte read, required user interaction, and local attack vector substantially limit real-world exploitation impact.
Heap out-of-bounds read in dnsmasq's find_soa() function allows a remote attacker controlling a DNS zone to leak up to 10 bytes of stale heap memory by serving a crafted NXDOMAIN response. The flaw exists because extract_name() is invoked with extrabytes=0 when parsing NS section records, skipping the mandatory boundary check for the 10-byte fixed-length DNS record trailer fields. Confirmed affected platforms include Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4; no public exploit or CISA KEV listing has been identified at time of analysis.
OpenSSH's GSSAPI authentication cleanup routine contains a heap out-of-bounds read (CWE-125) triggered when the auth-indicators array lacks a trailing NULL terminator, allowing a remote unauthenticated attacker to crash the SSH authentication path and deny SSH service availability. Exploitation is constrained by high attack complexity (AC:H) due to the non-default Kerberos/GSSAPI configuration requirement, limiting real-world exposure to a minority of deployments. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and the impact is restricted to partial availability loss with no confidentiality or integrity consequence.
X11 forwarding session hijacking in OpenSSH enables a local unprivileged attacker sharing a Linux client host to intercept and partially manipulate the victim's forwarded X11 display traffic by squatting on the predictable abstract UNIX domain socket name before the SSH client creates it. Affected deployments span OpenSSH packages across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, but successful exploitation yields high-confidence access to sensitive X11 session data including keystrokes, window contents, and clipboard material.
Client-side Denial of Service in OpenSSH's Diffie-Hellman Group Exchange implementation allows a malicious SSH server to crash connecting clients running in FIPS mode. When a victim initiates an SSH connection to an attacker-controlled server, the server sends crafted DH-GEX group parameters that trigger a double free (CWE-415) during FIPS known-group validation, terminating the client process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the constraint that only FIPS-mode clients are affected limits real-world impact to regulated or government environments.
Malformed HTTP Range request handling in libsoup (GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6-10) re-introduces a signed integer underflow originally patched in CVE-2026-2443. A rework commit replaced specific overflow guards with a general signed comparison, meaning a suffix-byte Range request whose length exceeds the resource content size now produces a negative start offset that is passed unclamped to buffer operations, generating malformed HTTP 206 responses and log flooding. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector makes any exposed libsoup HTTP server reachable without credentials.
Heap-based buffer overflow in dnsmasq's DNSSEC logging path enables remote denial of service against instances where both DNSSEC validation and query logging are simultaneously enabled. When dnsmasq receives a DS or DNSKEY DNS response containing an algorithm or digest type it does not recognize, its logging routine writes past the end of an internal heap-allocated buffer, corrupting memory and crashing the process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-deliverable attack vector (PR:N) makes the configuration prerequisite the primary limiting factor for defenders.
Use-after-free in 389 Directory Server's schema reload path crashes the server when administrative schema reloads race against active LDAP query worker threads. The `attr_syntax_swap_ht()` function bypasses the refcount-based deferred deletion mechanism used throughout the attribute syntax subsystem, directly freeing nodes that concurrent worker threads may still hold references to. Affected products span Red Hat Directory Server 11, 12, and 13 across RHEL 6 through 10; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.0 reflects the high-complexity, high-privilege prerequisites that substantially reduce real-world risk.
Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to the `aci` attribute to silently corrupt heap memory in the directory server process by submitting a malformed Access Control Instruction string. The `__aclp__normalize_acltxt()` function in `aclparse.c` performs pointer arithmetic on the keyword portion of an ACI string without validating minimum remaining buffer length after whitespace stripping, resulting in a 1-byte out-of-bounds write followed by out-of-bounds reads (CWE-787). No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available via GitHub PR #7542 but a released patched version has not been independently confirmed.
Arbitrary file deletion in evolution-data-server's addressbook file backend exposes host filesystem to manipulation by a Flatpak application with D-Bus access. The vulnerability exploits split validation logic: a crafted URI embedding directory traversal sequences (e.g., '../') is accepted without sufficient sanitization during contact creation or modification, but when the same URI is later processed at deletion time, a second, less restrictive check fails to catch the traversal - allowing files outside the intended addressbook directory to be removed. Critically, deletion of Flatpak override files could be leveraged to silently weaken sandbox restrictions for subsequent application runs. No public exploit has been identified at time of analysis.
Use-after-free memory corruption in GnuTLS's PKCS#11 PIN management function `gnutls_pkcs11_token_set_pin` enables a local low-privileged attacker to crash the process and potentially corrupt memory on systems where PKCS#11 tokens are deployed without a protected authentication path. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4, as confirmed by Red Hat (reporter) and covered under GnuTLS upstream advisory GNUTLS-SA-2026-04-29-9. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in GStreamer's AV1 codec parser (gst-plugins-bad) allows a remote unauthenticated attacker to crash any application using GStreamer for AV1 media playback by delivering a specially crafted AV1 file. The root cause is a unit mismatch in the gst_av1_parser_parse_tile_list_obu() function, which feeds a byte count to an API expecting a bit count, desynchronizing the parser and triggering an assertion abort. No public exploit has been identified at time of analysis, and exploitation requires user interaction; however, the vulnerability affects Red Hat Enterprise Linux 6 through 10 where GStreamer is a core multimedia component.
Out-of-bounds read vulnerabilities in GStreamer's pcapparse element expose Red Hat Enterprise Linux 6 through 10 users to potential application crashes or limited memory disclosure when processing malformed PCAP files. The flaws reside in IPv4/TCP header parsing logic, where specially crafted PCAP records trigger reads beyond buffer boundaries across multiple code paths. Real-world exposure is materially constrained by pcapparse's restriction to debugging pipelines, the requirement for local user interaction, and high attack complexity; no public exploit or active exploitation has been identified at time of analysis.
Content injection in libreport's ABRT post-create event handler grants a low-privileged local user the ability to control file content that the root process writes into crash dump directories. When a monitored process crashes, the event handler script queries the systemd journal for matching log entries and writes the results directly to dump directory files without stripping embedded control characters - allowing an attacker who can write syslog messages to pre-position newline-delimited payloads that corrupt or inject arbitrary lines into those root-owned files. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to local access with low privileges.
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The flaw exists because the virtio-blk device omits validation of input descriptor sizes prior to writing data, enabling a malicious guest operator to submit a crafted virtio-blk SCSI request that writes beyond the allocated host heap buffer. The primary confirmed impact is a denial of service (DoS) of the QEMU process on the host; no public exploit code has been identified at time of analysis and it is not listed in the CISA KEV catalog.
Stack buffer overflow in GStreamer's H.265/HEVC codec parser (gst-plugins-bad) allows remote unauthenticated attackers to crash GStreamer-based applications by delivering a crafted H.265 video file or stream that a user opens. The root cause is an incorrect loop bound in the buffering period SEI message parser: the parser mistakenly uses cpb_cnt_minus1[i] (the current loop index variable) rather than cpb_cnt_minus1[0] from the referenced Sequence Parameter Set, causing the loop to iterate beyond the bounds of stack-allocated CPB delay arrays and corrupt stack memory. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the deterministic parser logic makes crash reproduction straightforward.
Out-of-bounds write in GStreamer's H.266/VVC PPS picture partition parser (`gst-plugins-bad`) allows an attacker to crash media-processing applications - and potentially achieve code execution - by delivering a crafted H.266/VVC media file. The flaw in `gst_h266_parser_parse_picture_partition()` (gsth266parser.c) permits unbounded slice index increments across three fixed-size arrays in `GstH266PPS` during multi-slice-in-tile processing. A proof-of-concept demonstrating at least a 4-byte write exists; no public exploit beyond that initial POC or CISA KEV listing has been identified at time of analysis, though the code structure permits larger writes across multiple iterations which elevates downstream risk above a pure DoS assessment.
Heap out-of-bounds read in MIT krb5's LDAP KDB plugin allows a compromised or malicious LDAP backend to crash the KDC or kadmind process, or leak heap memory. The flaw exists in berval2tl_data() within libkdb_ldap and is triggered when the LDAP server returns a krbExtraData attribute with bv_len less than 2, causing an unsigned integer underflow that drives a memcpy of up to 65,534 bytes from a near-zero-length source buffer. Exploitation requires prior control of the LDAP KDB backend server (PR:H, AC:H), constraining real-world risk to insider or supply-chain threat scenarios; no public exploit or CISA KEV listing exists at time of analysis.
Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replication supplier to crash the server or corrupt heap memory by creating objectclass definitions with excessively long SUP (oc_superior) values. The flaw exists in schema serialization functions where the SUP field length is excluded from buffer size calculations yet still written via strcat(), producing an off-by-N heap overwrite. This is explicitly an incomplete fix variant of CVE-2025-14905, meaning organizations that patched that prior CVE may remain exposed if the SUP field code path was not remediated; no public exploit has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server's audit logging subsystem allows an authenticated high-privilege attacker to corrupt heap memory and tamper with audit log output. The vulnerable function create_masked_entry_string() in auditlog.c writes a fixed-length password mask into a precisely-sized heap buffer without bounds checking, overflowing when a short cleartext password is processed. Exploitation requires two non-default preconditions - audit logging must be enabled AND either CLEAR password storage must be configured or a replication peer must already be compromised - limiting real-world exposure significantly. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack buffer overflow in 389 Directory Server's pw.c checkPrefix() function allows a network-accessible Directory Manager to crash the LDAP server by storing a crafted credential with an oversized algorithm ID. The vulnerable code copies attacker-controlled input into a fixed 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. FORTIFY_SOURCE compiler hardening constrains impact to denial of service - preventing arbitrary code execution - but service disruption against a critical authentication infrastructure component remains operationally significant. No public exploit identified at time of analysis.
Uncontrolled CPU consumption in Red Hat 389 Directory Server's PBKDF2-SHA256 password storage plugin allows a highly privileged attacker who has write access to stored password hashes to craft a hash embedding an arbitrarily large iteration count, causing the LDAP server to exhaust CPU resources during any subsequent authentication attempt by the targeted user. Affected products span Red Hat Directory Server 11 through 13 and the 389-ds package as shipped across Red Hat Enterprise Linux 6 through 10. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP service by submitting a crafted password hash shorter than 16 bytes during authentication. The SMD5 password storage plugin performs an unsigned integer underflow (CWE-191) when computing salt length from this malformed input, producing a buffer over-read that terminates the server process. No public exploit code exists and this vulnerability has not been confirmed actively exploited (CISA KEV), but the impact is a complete loss of LDAP availability with low attack complexity once the required privilege level is achieved.
Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confidentiality, integrity, and availability impact via crafted string filter input. The flaw affects authenticated, network-accessible LDAP servers running Red Hat Directory Server 11, 12, and 13 as well as the 389-ds component shipped across Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; however, its presence in filter parsing logic - a core LDAP code path - warrants prompt patching in internet-exposed or multi-tenant directory environments.
Partial stack address disclosure in Red Hat 389 Directory Server (versions 11, 12, and 13) allows authenticated remote users to extract memory layout information via crafted LDAP extended operation requests. The root cause is a CWE-843 type confusion in the SSO token extended operation handler, which causes stack pointer data to bleed into LDAP response payloads. While the direct impact is limited to low-confidence information disclosure, leaked stack addresses are a classic ASLR-weakening primitive that could facilitate chained exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attacker during database import operations. Exploitation requires local system access, high attack complexity, and high privileges (administrator-level), producing only minor confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis and no KEV listing; the CVSS score of 1.9 reflects the extremely constrained exploitation conditions, making this a low operational priority absent specific threat model considerations.
Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticated network clients to exhaust server memory by initiating a sync operation and halting consumption of responses, causing unbounded queue growth until the server becomes unavailable. Compounding this, race conditions in the plugin's thread lifecycle management can independently trigger server crashes during connection teardown or graceful shutdown. Affected across Red Hat Directory Server 11, 12, and 13 as well as the bundled 389-ds-base package on RHEL 6 through 10. No public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free read in X.Org X server and Xwayland's CreateSaverWindow() function exposes heap memory to local authenticated users, resulting in information disclosure. A low-privileged local X client can manipulate window attributes and force screen saver activation to trigger a read from freed memory, leaking potentially sensitive heap contents (C:H/I:N/A:N). No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, an upstream fix commit has been published and a Red Hat advisory is available.
Out-of-bounds read in X.Org X server and Xwayland's GLX extension handler `__glXDisp_ChangeDrawableAttributes()` allows a local low-privileged user to disclose sensitive memory contents from the X server process. Faulty size validation permits reading a client-controlled number of bytes beyond the request buffer boundary, resulting in high confidentiality impact per CVSS. A secondary write path exists in the same function but is gated behind byte-swapped client support, which is disabled by default, substantially limiting its practical exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary OS commands with elevated privileges by supplying a crafted Manufacturer Usage Description (MUD) URL. Exploitation is strictly limited to systems where an administrator has explicitly reconfigured NetworkManager to use the dhclient backend - a non-default setting - meaning the vast majority of deployments are unaffected by design. CVSS 6.7 (local vector, high complexity, user interaction required) accurately reflects the constrained exploitation conditions; no public exploit code or CISA KEV listing exists at time of analysis.
GnuTLS's PKCS#7 padding validation during decryption is not implemented as a constant-time operation, creating a timing side-channel (CWE-208) that remote unauthenticated attackers can exploit to infer padding byte values on CBC-mode cipher suites. Affected deployments include GnuTLS as packaged across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Red Hat has issued patch RHSA-2026:20613; no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified, but the network-reachable, no-auth-required attack surface warrants patching on systems handling sensitive encrypted traffic.
HTTP request smuggling in libsoup allows remote unauthenticated attackers to exploit an unsigned-to-signed integer conversion error in the `soup_body_input_stream_read_chunked()` function via a crafted HTTP request. The vulnerability is confined to specific proxy topologies where libsoup operates either behind or in front of a non-libsoup HTTP intermediary, and successful exploitation can result in authentication bypass, web cache poisoning, or unauthorized access. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity and confidentiality impacts warrant urgent attention in any affected mixed-proxy deployment.
Denial of service in glib-networking allows a remote unauthenticated attacker to exhaust CPU resources in any application using the library's GnuTLS backend for certificate verification. By presenting a TLS certificate chain containing circular issuer relationships, the attacker triggers an unbounded loop (CWE-835) in the verification logic that never terminates. EPSS data was not provided; no public exploit code and no CISA KEV listing exist at time of analysis, placing this firmly in the 'monitor and patch' tier rather than emergency response.
Memory corruption via an off-by-one error in GnuTLS PKCS#12 bag element handling exposes any application using GnuTLS to remote unauthenticated denial of service - and potentially unspecified further impact - when a crafted PKCS#12 structure is parsed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated complexity, making internet-exposed services that parse client-supplied PKCS#12 inputs the primary risk surface. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in X.Org X Server XKB modifier map handling allows local authenticated attackers to read sensitive memory or crash the server by sending malformed X11 requests. The vulnerability affects RHEL 6 through 10 and requires local access with user-level privileges; exploitation results in information disclosure or denial of service.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in dnsmasq's DNSSEC validation code allows an attacker who operates any DNSSEC-signed authoritative zone to permanently hang the dnsmasq process with a single crafted DNS response, killing all DNS resolution for every client served by that instance. Affected deployments include dnsmasq as packaged in Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis; the assigned CVSS score of 4.4 (Medium) carries a notable inconsistency between the stated local attack vector and the network-delivered attack mechanism described.
Privileged file corruption and denial of service in sblim-sfcb (Small Footprint CIM Broker) on Red Hat Enterprise Linux 6 through 10 is achievable by a local low-privileged attacker exploiting a symlink-based race condition during privileged instance migration. The SFCB daemon writes to a temporary file in /tmp without atomic safety guarantees, allowing an attacker who repeatedly races a symbolic link into place to redirect that privileged write to an arbitrary file path. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds memory read in sblim-sfcb's provider-manager IPC message parser allows a local low-privileged attacker to crash the provider-manager process, causing denial of service and potentially leaking limited adjacent memory contents. The vulnerability stems from unsafe deserialization of attacker-controlled IPC messages without adequate boundary validation, affecting sblim-sfcb as shipped across Red Hat Enterprise Linux versions 6 through 10. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained to local system access.
Insecure temporary file creation in sblim-cmpi-base provider registration scripts exposes Red Hat Enterprise Linux 6 through 10 to a local symlink attack, enabling a low-privileged user to redirect privileged file writes to arbitrary paths. When registration scripts execute under elevated (root) privileges, an attacker who pre-positions a symlink in a world-writable directory can cause those scripts to overwrite root-owned files, disrupting system services or integrity. No public exploit code has been identified at time of analysis, and exploitation requires both local access and favorable timing, but the integrity and availability impact on a compromised host are rated high by the vendor.
Integer underflow in GStreamer's avidemux element allows a remote unauthenticated attacker to trigger heap out-of-bounds read and write, heap memory disclosure, and application crash by delivering a crafted AVI file containing a malformed FUJIFILM strd chunk. The gst_avi_demux_parse_strd() function decrements its remaining-length counter by fixed offsets without bounds checking, causing unsigned integer wraparound for payloads of exactly 106 or 107 bytes. Because avidemux is auto-plugged by GStreamer's high-level components (playbin, decodebin, gst-discoverer), any application that opens or previews a media file - including GNOME Files, Nautilus, Totem, and many others - can trigger the vulnerability without user awareness. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available in gst-plugins-good 1.28.6.
Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash the directory service with a single crafted BIND request. The flaw resides in `get_ldapmessage_controls_ext()`, which frees a parsed controls array when rejecting an unknown critical Session Tracking control but fails to clear the corresponding SLAPI_REQCONTROLS pblock slot - causing operation teardown to free the same pointer a second time. Affected deployments include Red Hat Directory Server 11 through 13 and the 389-ds-base package across all supported RHEL versions (6-10). No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS AC:H rating reflects that reliable heap exploitation requires specific memory layout conditions rather than a trivially repeatable one-shot crash.
NULL pointer dereference in the shim application's dp.c library exposes Red Hat Enterprise Linux 7, 8, and 9 systems using UEFI Secure Boot to a local denial-of-service condition. An attacker with high local privileges and the ability to interact with the shim boot path can trigger the missing NULL pointer check, potentially disrupting the boot process. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.9 reflects the constrained attack prerequisites, though the changed scope (S:C) signals that the impact crosses from the shim component into the broader boot environment.
Sensitive guest disk contents are exposed to any local user on Red Hat Enterprise Linux KVM hosts due to `qemu-img` creating new volume image files with world-readable permissions during libvirt storage clone or convert operations. Affected platforms span RHEL 6 through 10 and RHEL for Nvidia 26. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, but the CVSS C:H rating reflects full guest disk exposure to a low-privileged local attacker.
Signed integer overflow in GIMP's file-fli plugin causes application crashes when processing maliciously crafted FLI animation files, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where incorrect multiplication of image width and height during buffer size calculation can overflow a signed integer, producing an invalid allocation. No public exploit code or active exploitation has been identified; impact is strictly limited to availability, with no confidentiality or integrity consequences.
Missing authorization on CleanAllRUV and Abort CleanAllRUV LDAP extended operations in 389 Directory Server (Red Hat Directory Server 11-13) allows unauthenticated remote attackers - when the default anonymous access setting is active - to manipulate replication metadata, purge changelog records, and abort administrator-initiated cleanup tasks. The affected operations are replication-maintenance primitives that bypass the authorization layer entirely (CWE-862), meaning no account or session is required under default configuration. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the network-accessible, zero-authentication attack surface in a widely deployed enterprise directory server makes this a notable availability and integrity risk.
Integer overflow in p11-kit's RPC message parser on 32-bit systems allows a local attacker, or any principal with access to a reachable RPC channel, to crash the p11-kit process via a heap out-of-bounds write, resulting in Denial of Service. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in `print_hw_addr()` and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.
Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SSRF bypass in stunnel 5.79 and earlier allows authenticated SOCKS proxy clients to circumvent intended localhost access restrictions by supplying IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) in proxy requests. Exploitation reaches loopback-bound services on the stunnel host - services deliberately isolated from external network access - potentially exposing internal APIs, administrative interfaces, or other localhost-only endpoints. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Uninitialized heap memory disclosure in SSSD's NSS responder exposes cached directory data and heap layout to local authenticated users on RHEL 6 through 10 and OpenShift Container Platform 4. The sss_nss_protocol_fill_initgr() function pre-allocates a reply buffer sized for all group entries but fails to shrink it when groups are skipped, causing uninitialized heap bytes to be included in the response transmitted back to the requesting client. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, leaked heap addresses may assist in chained attacks targeting ASLR bypass in sssd_nss.
GNU tar's incremental restore path contains a TOCTOU race condition in dumpdir 'X' rename handling, allowing a local attacker with write access to a backed-up directory to redirect file operations outside the intended extraction root during a privileged restore. Successful exploitation can result in arbitrary file creation, rename, or overwrite - enabling privilege escalation on systems running Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis, and no CISA KEV listing exists; the CVSS score of 4.4 reflects the constrained attack prerequisites including a required race window and administrator-initiated restore.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
GNU tar's --one-top-level extraction mode fails to confine hardlink targets to the designated top-level directory, allowing a crafted archive to plant hardlinks that escape the intended extraction boundary. When combined with a preexisting symbolic link already present under the working directory, an attacker who can induce a victim to extract a malicious archive may read or write files outside the intended extraction scope on systems running affected RHEL versions (6 through 10) and Red Hat Hardened Images. No public exploit has been identified at time of analysis, and exploitation requires both user interaction and a specific environmental pre-condition, keeping real-world risk moderate despite GNU tar's ubiquitous deployment.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Timing side-channel exposure in Red Hat Directory Server's PBKDF2-SHA256 password verification allows a remote unauthenticated attacker to send repeated LDAP bind requests and statistically infer partial hash information by measuring response-time differences caused by non-constant-time memcmp() comparisons. Affected deployments span Red Hat Directory Server 11 through 13 and the 389-ds-base package shipped across RHEL 6 through 10. No public exploit identified at time of analysis, and practical exploitation is acknowledged to be extremely difficult due to the computational overhead inherent in PBKDF2 key stretching, which substantially degrades the timing signal.
Attribute encryption in the 389-ds-base LDBM backend exposes a cryptographic design flaw affecting Red Hat Directory Server 11, 12, and 13 across all supported RHEL releases (6 through 10). The LDBM backend applies a static, hardcoded initialization vector (IV) for both AES-CBC and 3DES-CBC encryption of directory attribute values, meaning that two entries storing identical plaintext for an encrypted attribute will always produce identical ciphertext blocks - a classic ciphertext equality oracle. An attacker with privileged filesystem-level read access to the LDBM database files can exploit this to determine whether any two encrypted attribute values are identical, leaking relational information about the directory without recovering plaintext. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Heap-buffer-overflow in 389 Directory Server's DN normalization routine allows an unauthenticated remote attacker to corrupt heap memory and likely crash the LDAP service. The flaw triggers when the server processes an LDAP operation - such as a search request - whose base DN contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), causing an out-of-bounds write during RDN attribute-value pair sorting. Per the confirmed CVSS vector (PR:N), no authentication is required; no public exploit code or CISA KEV listing has been identified at time of analysis.
Integer overflow in GIMP's PlayStation TIM image loader crashes the plug-in when processing a maliciously crafted TIM file, resulting in denial of service. The flaw affects GIMP as packaged on Red Hat Enterprise Linux 6 through 9, where the TIM loader multiplies two 16-bit unsigned short values (num_colors × num_cluts) without bounds checking, producing a 32-bit overflow that corrupts CLUT size calculation and triggers an abort. No public exploit code has been identified at time of analysis, and exploitation requires user interaction to open a crafted file, limiting real-world impact to targeted social engineering scenarios.
Two off-by-one errors in FreeIPA's ipa-otpd daemon expose RHEL 6 through 10 deployments configured with an external OAuth2/OIDC Identity Provider to out-of-bounds memory access during the device authorization flow. An attacker who controls or can man-in-the-middle the configured IdP endpoint can serve an oversized authorization response, triggering CWE-787 writes or reads one byte past a fixed-size buffer boundary. The most probable outcome is denial of service of the ipa-otpd daemon; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.
Double-free memory corruption in GIMP's PSP file format parser exposes local users to denial of service and potential arbitrary code execution when opening a specially crafted Paint Shop Pro image file. The flaw in read_layer_block() allows heap memory corruption that reliably crashes GIMP and, in a more sophisticated exploitation scenario, could enable arbitrary code execution with the privileges of the victim user. No public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, though upstream tagging of the issue as RCE-capable warrants patching in environments where GIMP users may open untrusted image files.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Stack exhaustion in p11-kit's RPC server crashes the daemon and any dependent cryptographic services on affected Red Hat systems. The vulnerability exists in the PKCS#11 RPC message parsing layer, where two attribute-handling functions form a mutually-recursive call chain with no depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes - allowing any local user or process with socket access to crash the server by sending a single crafted request. No public exploit or active exploitation has been identified at time of analysis, and impact is limited to availability (denial of service) with no confidentiality or integrity consequence.
Heap use-after-free read in libblkid (util-linux) enables unauthenticated local attackers to crash udisks or leak root-process heap data by presenting a crafted block device image during nested partition probing. BSD, Minix, Solaris x86, and UnixWare partition table parsers cache raw pointers into a dynamically allocated partition array; when subsequent partition additions trigger array reallocation, those pointers become stale and dereference freed memory. Because udev and udisks invoke libblkid automatically as root on block-device hot-plug events, USB insertion alone is sufficient to trigger the flaw without any user interaction or authentication. No public exploit identified at time of analysis.
Path traversal in spice-vdagent enables a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system during file transfer operations. Affecting Red Hat Enterprise Linux versions 6 through 10, the flaw stems from unsanitized filenames supplied by the SPICE host before use by the vdagent process, allowing writes at the privilege level of the logged-in guest user. No public exploit is identified at time of analysis, and exploitation requires prior control of the SPICE host - a high-privilege precondition that substantially constrains realistic risk despite the high integrity impact.
Integer overflow in spice-vdagent's message parsing allows a malicious or compromised SPICE host to crash the guest VM's vdagent daemon by delivering a specially crafted message that triggers a downstream heap buffer overflow. Affected deployments span spice-vdagent as packaged in Red Hat Enterprise Linux 6 through 10, where the daemon runs inside guests handling host-to-guest SPICE protocol communications. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is structurally constrained by the requirement that the attacking SPICE host itself be untrusted or already compromised prior to the attack.
Heap out-of-bounds read in GStreamer's gst-plugins-bad H.264 parser allows an attacker to crash a media application or leak a single byte of heap memory by tricking a victim into opening a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units. Affected systems span Red Hat Enterprise Linux versions 6 through 10 where gst-plugins-bad is installed. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the narrow 1-byte read, required user interaction, and local attack vector substantially limit real-world exploitation impact.
Heap out-of-bounds read in dnsmasq's find_soa() function allows a remote attacker controlling a DNS zone to leak up to 10 bytes of stale heap memory by serving a crafted NXDOMAIN response. The flaw exists because extract_name() is invoked with extrabytes=0 when parsing NS section records, skipping the mandatory boundary check for the 10-byte fixed-length DNS record trailer fields. Confirmed affected platforms include Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4; no public exploit or CISA KEV listing has been identified at time of analysis.
OpenSSH's GSSAPI authentication cleanup routine contains a heap out-of-bounds read (CWE-125) triggered when the auth-indicators array lacks a trailing NULL terminator, allowing a remote unauthenticated attacker to crash the SSH authentication path and deny SSH service availability. Exploitation is constrained by high attack complexity (AC:H) due to the non-default Kerberos/GSSAPI configuration requirement, limiting real-world exposure to a minority of deployments. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and the impact is restricted to partial availability loss with no confidentiality or integrity consequence.
X11 forwarding session hijacking in OpenSSH enables a local unprivileged attacker sharing a Linux client host to intercept and partially manipulate the victim's forwarded X11 display traffic by squatting on the predictable abstract UNIX domain socket name before the SSH client creates it. Affected deployments span OpenSSH packages across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, but successful exploitation yields high-confidence access to sensitive X11 session data including keystrokes, window contents, and clipboard material.
Client-side Denial of Service in OpenSSH's Diffie-Hellman Group Exchange implementation allows a malicious SSH server to crash connecting clients running in FIPS mode. When a victim initiates an SSH connection to an attacker-controlled server, the server sends crafted DH-GEX group parameters that trigger a double free (CWE-415) during FIPS known-group validation, terminating the client process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the constraint that only FIPS-mode clients are affected limits real-world impact to regulated or government environments.
Malformed HTTP Range request handling in libsoup (GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6-10) re-introduces a signed integer underflow originally patched in CVE-2026-2443. A rework commit replaced specific overflow guards with a general signed comparison, meaning a suffix-byte Range request whose length exceeds the resource content size now produces a negative start offset that is passed unclamped to buffer operations, generating malformed HTTP 206 responses and log flooding. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector makes any exposed libsoup HTTP server reachable without credentials.
Heap-based buffer overflow in dnsmasq's DNSSEC logging path enables remote denial of service against instances where both DNSSEC validation and query logging are simultaneously enabled. When dnsmasq receives a DS or DNSKEY DNS response containing an algorithm or digest type it does not recognize, its logging routine writes past the end of an internal heap-allocated buffer, corrupting memory and crashing the process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the network-deliverable attack vector (PR:N) makes the configuration prerequisite the primary limiting factor for defenders.
Use-after-free in 389 Directory Server's schema reload path crashes the server when administrative schema reloads race against active LDAP query worker threads. The `attr_syntax_swap_ht()` function bypasses the refcount-based deferred deletion mechanism used throughout the attribute syntax subsystem, directly freeing nodes that concurrent worker threads may still hold references to. Affected products span Red Hat Directory Server 11, 12, and 13 across RHEL 6 through 10; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.0 reflects the high-complexity, high-privilege prerequisites that substantially reduce real-world risk.
Heap buffer overflow in 389 Directory Server's ACI parsing layer allows an authenticated LDAP user with write access to the `aci` attribute to silently corrupt heap memory in the directory server process by submitting a malformed Access Control Instruction string. The `__aclp__normalize_acltxt()` function in `aclparse.c` performs pointer arithmetic on the keyword portion of an ACI string without validating minimum remaining buffer length after whitespace stripping, resulting in a 1-byte out-of-bounds write followed by out-of-bounds reads (CWE-787). No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available via GitHub PR #7542 but a released patched version has not been independently confirmed.
Arbitrary file deletion in evolution-data-server's addressbook file backend exposes host filesystem to manipulation by a Flatpak application with D-Bus access. The vulnerability exploits split validation logic: a crafted URI embedding directory traversal sequences (e.g., '../') is accepted without sufficient sanitization during contact creation or modification, but when the same URI is later processed at deletion time, a second, less restrictive check fails to catch the traversal - allowing files outside the intended addressbook directory to be removed. Critically, deletion of Flatpak override files could be leveraged to silently weaken sandbox restrictions for subsequent application runs. No public exploit has been identified at time of analysis.
Use-after-free memory corruption in GnuTLS's PKCS#11 PIN management function `gnutls_pkcs11_token_set_pin` enables a local low-privileged attacker to crash the process and potentially corrupt memory on systems where PKCS#11 tokens are deployed without a protected authentication path. Affected deployments span Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4, as confirmed by Red Hat (reporter) and covered under GnuTLS upstream advisory GNUTLS-SA-2026-04-29-9. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in GStreamer's AV1 codec parser (gst-plugins-bad) allows a remote unauthenticated attacker to crash any application using GStreamer for AV1 media playback by delivering a specially crafted AV1 file. The root cause is a unit mismatch in the gst_av1_parser_parse_tile_list_obu() function, which feeds a byte count to an API expecting a bit count, desynchronizing the parser and triggering an assertion abort. No public exploit has been identified at time of analysis, and exploitation requires user interaction; however, the vulnerability affects Red Hat Enterprise Linux 6 through 10 where GStreamer is a core multimedia component.
Out-of-bounds read vulnerabilities in GStreamer's pcapparse element expose Red Hat Enterprise Linux 6 through 10 users to potential application crashes or limited memory disclosure when processing malformed PCAP files. The flaws reside in IPv4/TCP header parsing logic, where specially crafted PCAP records trigger reads beyond buffer boundaries across multiple code paths. Real-world exposure is materially constrained by pcapparse's restriction to debugging pipelines, the requirement for local user interaction, and high attack complexity; no public exploit or active exploitation has been identified at time of analysis.
Content injection in libreport's ABRT post-create event handler grants a low-privileged local user the ability to control file content that the root process writes into crash dump directories. When a monitored process crashes, the event handler script queries the systemd journal for matching log entries and writes the results directly to dump directory files without stripping embedded control characters - allowing an attacker who can write syslog messages to pre-position newline-delimited payloads that corrupt or inject arbitrary lines into those root-owned files. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to local access with low privileges.
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The flaw exists because the virtio-blk device omits validation of input descriptor sizes prior to writing data, enabling a malicious guest operator to submit a crafted virtio-blk SCSI request that writes beyond the allocated host heap buffer. The primary confirmed impact is a denial of service (DoS) of the QEMU process on the host; no public exploit code has been identified at time of analysis and it is not listed in the CISA KEV catalog.
Stack buffer overflow in GStreamer's H.265/HEVC codec parser (gst-plugins-bad) allows remote unauthenticated attackers to crash GStreamer-based applications by delivering a crafted H.265 video file or stream that a user opens. The root cause is an incorrect loop bound in the buffering period SEI message parser: the parser mistakenly uses cpb_cnt_minus1[i] (the current loop index variable) rather than cpb_cnt_minus1[0] from the referenced Sequence Parameter Set, causing the loop to iterate beyond the bounds of stack-allocated CPB delay arrays and corrupt stack memory. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the deterministic parser logic makes crash reproduction straightforward.
Out-of-bounds write in GStreamer's H.266/VVC PPS picture partition parser (`gst-plugins-bad`) allows an attacker to crash media-processing applications - and potentially achieve code execution - by delivering a crafted H.266/VVC media file. The flaw in `gst_h266_parser_parse_picture_partition()` (gsth266parser.c) permits unbounded slice index increments across three fixed-size arrays in `GstH266PPS` during multi-slice-in-tile processing. A proof-of-concept demonstrating at least a 4-byte write exists; no public exploit beyond that initial POC or CISA KEV listing has been identified at time of analysis, though the code structure permits larger writes across multiple iterations which elevates downstream risk above a pure DoS assessment.
Heap out-of-bounds read in MIT krb5's LDAP KDB plugin allows a compromised or malicious LDAP backend to crash the KDC or kadmind process, or leak heap memory. The flaw exists in berval2tl_data() within libkdb_ldap and is triggered when the LDAP server returns a krbExtraData attribute with bv_len less than 2, causing an unsigned integer underflow that drives a memcpy of up to 65,534 bytes from a near-zero-length source buffer. Exploitation requires prior control of the LDAP KDB backend server (PR:H, AC:H), constraining real-world risk to insider or supply-chain threat scenarios; no public exploit or CISA KEV listing exists at time of analysis.
Heap buffer overflow in Red Hat 389 Directory Server allows an authenticated Directory Manager or a compromised replication supplier to crash the server or corrupt heap memory by creating objectclass definitions with excessively long SUP (oc_superior) values. The flaw exists in schema serialization functions where the SUP field length is excluded from buffer size calculations yet still written via strcat(), producing an off-by-N heap overwrite. This is explicitly an incomplete fix variant of CVE-2025-14905, meaning organizations that patched that prior CVE may remain exposed if the SUP field code path was not remediated; no public exploit has been identified at time of analysis.
Heap buffer overflow in Red Hat Directory Server's audit logging subsystem allows an authenticated high-privilege attacker to corrupt heap memory and tamper with audit log output. The vulnerable function create_masked_entry_string() in auditlog.c writes a fixed-length password mask into a precisely-sized heap buffer without bounds checking, overflowing when a short cleartext password is processed. Exploitation requires two non-default preconditions - audit logging must be enabled AND either CLEAR password storage must be configured or a replication peer must already be compromised - limiting real-world exposure significantly. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack buffer overflow in 389 Directory Server's pw.c checkPrefix() function allows a network-accessible Directory Manager to crash the LDAP server by storing a crafted credential with an oversized algorithm ID. The vulnerable code copies attacker-controlled input into a fixed 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. FORTIFY_SOURCE compiler hardening constrains impact to denial of service - preventing arbitrary code execution - but service disruption against a critical authentication infrastructure component remains operationally significant. No public exploit identified at time of analysis.
Uncontrolled CPU consumption in Red Hat 389 Directory Server's PBKDF2-SHA256 password storage plugin allows a highly privileged attacker who has write access to stored password hashes to craft a hash embedding an arbitrarily large iteration count, causing the LDAP server to exhaust CPU resources during any subsequent authentication attempt by the targeted user. Affected products span Red Hat Directory Server 11 through 13 and the 389-ds package as shipped across Red Hat Enterprise Linux 6 through 10. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP service by submitting a crafted password hash shorter than 16 bytes during authentication. The SMD5 password storage plugin performs an unsigned integer underflow (CWE-191) when computing salt length from this malformed input, producing a buffer over-read that terminates the server process. No public exploit code exists and this vulnerability has not been confirmed actively exploited (CISA KEV), but the impact is a complete loss of LDAP availability with low attack complexity once the required privilege level is achieved.
Heap buffer over-read in Red Hat Directory Server's ldap_utf8prev() function exposes LDAP deployments to potential confidentiality, integrity, and availability impact via crafted string filter input. The flaw affects authenticated, network-accessible LDAP servers running Red Hat Directory Server 11, 12, and 13 as well as the 389-ds component shipped across Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; however, its presence in filter parsing logic - a core LDAP code path - warrants prompt patching in internet-exposed or multi-tenant directory environments.
Partial stack address disclosure in Red Hat 389 Directory Server (versions 11, 12, and 13) allows authenticated remote users to extract memory layout information via crafted LDAP extended operation requests. The root cause is a CWE-843 type confusion in the SSO token extended operation handler, which causes stack pointer data to bleed into LDAP response payloads. While the direct impact is limited to low-confidence information disclosure, leaked stack addresses are a classic ASLR-weakening primitive that could facilitate chained exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attacker during database import operations. Exploitation requires local system access, high attack complexity, and high privileges (administrator-level), producing only minor confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis and no KEV listing; the CVSS score of 1.9 reflects the extremely constrained exploitation conditions, making this a low operational priority absent specific threat model considerations.
Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticated network clients to exhaust server memory by initiating a sync operation and halting consumption of responses, causing unbounded queue growth until the server becomes unavailable. Compounding this, race conditions in the plugin's thread lifecycle management can independently trigger server crashes during connection teardown or graceful shutdown. Affected across Red Hat Directory Server 11, 12, and 13 as well as the bundled 389-ds-base package on RHEL 6 through 10. No public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free read in X.Org X server and Xwayland's CreateSaverWindow() function exposes heap memory to local authenticated users, resulting in information disclosure. A low-privileged local X client can manipulate window attributes and force screen saver activation to trigger a read from freed memory, leaking potentially sensitive heap contents (C:H/I:N/A:N). No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, an upstream fix commit has been published and a Red Hat advisory is available.
Out-of-bounds read in X.Org X server and Xwayland's GLX extension handler `__glXDisp_ChangeDrawableAttributes()` allows a local low-privileged user to disclose sensitive memory contents from the X server process. Faulty size validation permits reading a client-controlled number of bytes beyond the request buffer boundary, resulting in high confidentiality impact per CVSS. A secondary write path exists in the same function but is gated behind byte-swapped client support, which is disabled by default, substantially limiting its practical exposure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary OS commands with elevated privileges by supplying a crafted Manufacturer Usage Description (MUD) URL. Exploitation is strictly limited to systems where an administrator has explicitly reconfigured NetworkManager to use the dhclient backend - a non-default setting - meaning the vast majority of deployments are unaffected by design. CVSS 6.7 (local vector, high complexity, user interaction required) accurately reflects the constrained exploitation conditions; no public exploit code or CISA KEV listing exists at time of analysis.
GnuTLS's PKCS#7 padding validation during decryption is not implemented as a constant-time operation, creating a timing side-channel (CWE-208) that remote unauthenticated attackers can exploit to infer padding byte values on CBC-mode cipher suites. Affected deployments include GnuTLS as packaged across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Red Hat has issued patch RHSA-2026:20613; no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified, but the network-reachable, no-auth-required attack surface warrants patching on systems handling sensitive encrypted traffic.
HTTP request smuggling in libsoup allows remote unauthenticated attackers to exploit an unsigned-to-signed integer conversion error in the `soup_body_input_stream_read_chunked()` function via a crafted HTTP request. The vulnerability is confined to specific proxy topologies where libsoup operates either behind or in front of a non-libsoup HTTP intermediary, and successful exploitation can result in authentication bypass, web cache poisoning, or unauthorized access. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity and confidentiality impacts warrant urgent attention in any affected mixed-proxy deployment.
Denial of service in glib-networking allows a remote unauthenticated attacker to exhaust CPU resources in any application using the library's GnuTLS backend for certificate verification. By presenting a TLS certificate chain containing circular issuer relationships, the attacker triggers an unbounded loop (CWE-835) in the verification logic that never terminates. EPSS data was not provided; no public exploit code and no CISA KEV listing exist at time of analysis, placing this firmly in the 'monitor and patch' tier rather than emergency response.
Memory corruption via an off-by-one error in GnuTLS PKCS#12 bag element handling exposes any application using GnuTLS to remote unauthenticated denial of service - and potentially unspecified further impact - when a crafted PKCS#12 structure is parsed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated complexity, making internet-exposed services that parse client-supplied PKCS#12 inputs the primary risk surface. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in X.Org X Server XKB modifier map handling allows local authenticated attackers to read sensitive memory or crash the server by sending malformed X11 requests. The vulnerability affects RHEL 6 through 10 and requires local access with user-level privileges; exploitation results in information disclosure or denial of service.