Red Hat Enterprise Linux 8
Monthly
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Sandbox escape in bubblewrap prior to 0.12.0 allows a local, low-privileged user to write files or directories to arbitrary host paths outside the sandbox boundary by exploiting symlink resolution during the pre-execution setup phase (CWE-59). The escape occurs via /oldroot - bubblewrap's bind-mounted original root - before the sandboxed process ever starts, meaning no code execution inside the sandbox is needed to trigger it. Distributions including Red Hat Enterprise Linux 8, 9, and 10 and Debian are confirmed affected; the upstream fix is available as bubblewrap 0.12.0 and no public exploit code has been identified at time of analysis.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Shell command injection in the Cockpit 389 Console allows an LDAP user with delegated entry-creation privileges to achieve root code execution on the directory server host. The 389-ds-base package, as deployed in Red Hat Directory Server 11/12/13 and RHEL 6-10, constructs ldapsearch commands by embedding LDAP distinguished names directly into shell strings without escaping metacharacters. An attacker controlling LDAP write access can plant a malicious DN; when a Cockpit administrator views that entry, injected shell commands execute with root privileges. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated integrity compromise in 389 Directory Server (shipped as Red Hat Directory Server 11/12/13 and bundled in RHEL 6-10) allows anonymous LDAP clients to bypass SELFDN-based access control checks. The SELFDN ACI bind-rule evaluator incorrectly equates an anonymous client's empty bind DN with an empty stored attribute value in a target directory entry, satisfying an ACI that was intended to permit only a matching authenticated identity. Exploitation enables anonymous directory modifications - including adding or altering entries - that SELFDN ACIs were designed to restrict to specific authenticated users. No public exploit has been identified at time of analysis.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in rpmuncompress allows a local attacker to execute arbitrary commands under the invoking user's context by supplying an archive file whose filename contains shell metacharacters. Affecting all actively supported Red Hat Enterprise Linux versions (6 through 10) and Red Hat Hardened Images, the flaw is triggered when a user or automated build pipeline invokes rpmuncompress on a maliciously named archive. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and broad RHEL enterprise deployment footprint make this a meaningful risk for organizations processing untrusted archives in development or CI/CD workflows.
Command injection in rpm's `rpmbuild -t*` subcommand allows arbitrary command execution with build-user privileges when an attacker controls the path or filename of a tarball being processed. The vulnerability arises because shell metacharacters in tarball names are not sanitized before being passed to a shell invocation inside rpmbuild. Exploitation is most realistic in automated CI/CD pipelines that fetch externally supplied artifact archives and pass them directly to rpmbuild, a common pattern in open-source package maintainer workflows. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Symlink traversal in util-linux's X-mount.subdir mount option allows a local unprivileged user with an fstab-authorized entry to redirect mount resolution to arbitrary host paths, achieving privilege escalation or container escape on Linux 6.15+ kernels. The root cause is that AT_SYMLINK_NOFOLLOW, passed to open_tree() in the detached-tree fast path, only blocks final-component symlinks - not intermediate path components - leaving an attacker who can plant a symlink in a middle directory able to substitute the intended subdirectory with any host path. Affected platforms include Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; no public exploit has been identified at time of analysis.
Local privilege escalation in util-linux's SUID mount(8) binary exposes all major Red Hat Enterprise Linux versions (7-10), Red Hat Hardened Images, and OpenShift Container Platform 4 to root-level file ownership and permission manipulation by low-privileged local users. The flaw stems from a time-of-check to time-of-use (TOCTOU) race: mount(8) reads the bind-mount source from fstab but does not pin the resolved inode before issuing the privileged syscall, allowing an attacker with write access to the source path or a writable ancestor to substitute an arbitrary host directory. When fstab entries additionally specify X-mount.owner, X-mount.group, or X-mount.mode, root subsequently applies chown or chmod to the attacker-redirected path, completing the privilege escalation. No public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in util-linux's nsenter --join-cgroup option allows an unprivileged local user to move and terminate root-owned host processes by exploiting a persistent file descriptor opened as root that survives across namespace and credential changes. The kernel evaluates cgroup migration requests against the credentials held at fd-open time rather than the current caller's credentials, so any program that inherits the still-open cgroup.procs fd effectively retains root's cgroup management authority. Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are confirmed affected; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.
Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. CVSS rates this 7.5 (High) with full confidentiality impact; no public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity unauthenticated network vector makes this a credible threat wherever RESTEasy-backed XML endpoints are exposed.
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.
Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-buffer-overflow vulnerabilities in GIMP's APNG file loader and DDS plug-in allow code execution when a user opens a specially crafted image file. The APNG flaw is triggered when the fcTL chunk width exceeds the IHDR width, causing pixel data to overwrite memory beyond the heap allocation; the DDS flaw stems from a bits-per-pixel mismatch in load_layer(). Both affect GIMP as packaged on Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
Arbitrary command execution as root via udev property injection in sg3_utils when sg_inq --export parses a SCSI device with a crafted name string. Affects multiple Red Hat Enterprise Linux versions shipping sg3_utils. Publicly available exploit code exists as a proof-of-concept in the upstream fix; no active exploitation has been reported.
Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi-keyex authentication path fails to confirm that the authenticated Kerberos principal is actually authorized for the local user account being requested. An already-authenticated client holding any valid Kerberos principal in the realm can therefore log in as an arbitrary user, including potentially privileged accounts, on Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS of 8.8 reflects a straightforward, low-complexity abuse once a valid Kerberos credential is held.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in PipeWire's PulseAudio compatibility layer lets a low-privileged process inside a confined environment such as Flatpak load an attacker-controlled library and execute arbitrary code on the host user's session. The flaw (CWE-427) is present in PipeWire as shipped in Red Hat Enterprise Linux 7, 8, 9 and 10 and carries a scope-changing CVSS 3.1 score of 8.8. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Sandbox escape in bubblewrap prior to 0.12.0 allows a local, low-privileged user to write files or directories to arbitrary host paths outside the sandbox boundary by exploiting symlink resolution during the pre-execution setup phase (CWE-59). The escape occurs via /oldroot - bubblewrap's bind-mounted original root - before the sandboxed process ever starts, meaning no code execution inside the sandbox is needed to trigger it. Distributions including Red Hat Enterprise Linux 8, 9, and 10 and Debian are confirmed affected; the upstream fix is available as bubblewrap 0.12.0 and no public exploit code has been identified at time of analysis.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Shell command injection in the Cockpit 389 Console allows an LDAP user with delegated entry-creation privileges to achieve root code execution on the directory server host. The 389-ds-base package, as deployed in Red Hat Directory Server 11/12/13 and RHEL 6-10, constructs ldapsearch commands by embedding LDAP distinguished names directly into shell strings without escaping metacharacters. An attacker controlling LDAP write access can plant a malicious DN; when a Cockpit administrator views that entry, injected shell commands execute with root privileges. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward.
Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.
Heap buffer overflow in 389 Directory Server's SASL I/O layer allows a remote authenticated attacker to crash the server or potentially execute arbitrary code. The root cause is an integer underflow in `sasl_io_read_packet()`: a crafted SASL record with a wire-format length of 0, 1, or 2 bytes causes an unsigned subtraction to wrap around, instructing `PR_Recv` to read approximately 4 GiB of attacker-controlled network data into a 1024-byte heap buffer. The flaw is explicitly distinct from CVE-2026-11774, whose patch addressed only upper-bound validation, leaving the lower-bound path unguarded. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated integrity compromise in 389 Directory Server (shipped as Red Hat Directory Server 11/12/13 and bundled in RHEL 6-10) allows anonymous LDAP clients to bypass SELFDN-based access control checks. The SELFDN ACI bind-rule evaluator incorrectly equates an anonymous client's empty bind DN with an empty stored attribute value in a target directory entry, satisfying an ACI that was intended to permit only a matching authenticated identity. Exploitation enables anonymous directory modifications - including adding or altering entries - that SELFDN ACIs were designed to restrict to specific authenticated users. No public exploit has been identified at time of analysis.
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in rpmuncompress allows a local attacker to execute arbitrary commands under the invoking user's context by supplying an archive file whose filename contains shell metacharacters. Affecting all actively supported Red Hat Enterprise Linux versions (6 through 10) and Red Hat Hardened Images, the flaw is triggered when a user or automated build pipeline invokes rpmuncompress on a maliciously named archive. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and broad RHEL enterprise deployment footprint make this a meaningful risk for organizations processing untrusted archives in development or CI/CD workflows.
Command injection in rpm's `rpmbuild -t*` subcommand allows arbitrary command execution with build-user privileges when an attacker controls the path or filename of a tarball being processed. The vulnerability arises because shell metacharacters in tarball names are not sanitized before being passed to a shell invocation inside rpmbuild. Exploitation is most realistic in automated CI/CD pipelines that fetch externally supplied artifact archives and pass them directly to rpmbuild, a common pattern in open-source package maintainer workflows. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Symlink traversal in util-linux's X-mount.subdir mount option allows a local unprivileged user with an fstab-authorized entry to redirect mount resolution to arbitrary host paths, achieving privilege escalation or container escape on Linux 6.15+ kernels. The root cause is that AT_SYMLINK_NOFOLLOW, passed to open_tree() in the detached-tree fast path, only blocks final-component symlinks - not intermediate path components - leaving an attacker who can plant a symlink in a middle directory able to substitute the intended subdirectory with any host path. Affected platforms include Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; no public exploit has been identified at time of analysis.
Local privilege escalation in util-linux's SUID mount(8) binary exposes all major Red Hat Enterprise Linux versions (7-10), Red Hat Hardened Images, and OpenShift Container Platform 4 to root-level file ownership and permission manipulation by low-privileged local users. The flaw stems from a time-of-check to time-of-use (TOCTOU) race: mount(8) reads the bind-mount source from fstab but does not pin the resolved inode before issuing the privileged syscall, allowing an attacker with write access to the source path or a writable ancestor to substitute an arbitrary host directory. When fstab entries additionally specify X-mount.owner, X-mount.group, or X-mount.mode, root subsequently applies chown or chmod to the attacker-redirected path, completing the privilege escalation. No public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in util-linux's nsenter --join-cgroup option allows an unprivileged local user to move and terminate root-owned host processes by exploiting a persistent file descriptor opened as root that survives across namespace and credential changes. The kernel evaluates cgroup migration requests against the credentials held at fd-open time rather than the current caller's credentials, so any program that inherits the still-open cgroup.procs fd effectively retains root's cgroup management authority. Red Hat Enterprise Linux 7-10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are confirmed affected; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.
Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. CVSS rates this 7.5 (High) with full confidentiality impact; no public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity unauthenticated network vector makes this a credible threat wherever RESTEasy-backed XML endpoints are exposed.
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.
Arbitrary code execution in Emacs TRAMP affects Red Hat Enterprise Linux 6 through 10 via a local command injection flaw in the TRAMP remote file access subsystem. TRAMP concatenates user-influenced login arguments - including filenames - without sanitization before passing them to a local shell, enabling a low-privileged local attacker to inject shell commands that execute with the victim process's privileges. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and no-user-interaction requirement make this a credible local privilege escalation vector on multi-user RHEL systems.
Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
Macro injection in rpmbuild's tarball mode allows arbitrary code execution on systems running Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. When rpmbuild processes a tarball in tarball mode, specially crafted tar member names are interpreted as RPM macros, enabling an attacker who can distribute a malicious tarball to achieve full RCE in the context of the user running the build. No public exploit or active exploitation has been identified at time of analysis, but the social-engineering requirement is realistic in open-source build pipeline contexts where developers routinely fetch and build third-party source tarballs.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Memory exhaustion in FreeIPA's `/ipa/i18n_messages` endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to `/ipa/migration/migration.py`, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Code injection in the Perl DBI module as packaged for Red Hat Enterprise Linux allows a network-accessible, low-privileged attacker to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise. This CVE is a remediation of an incomplete fix for CVE-2026-14380, specifically targeting RHEL 9.8.z and 10.2.z patch levels where the prior partial fix left an exploitable residual path. No public exploit or CISA KEV listing is identified at time of analysis, but the CWE-94 classification and RCE tag indicate high potential impact if exploitation conditions are met.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens a maliciously crafted .psd file. An unsigned integer underflow in the plugin's block_rem length variable (CWE-191) corrupts parsing of Photoshop layer resource blocks, letting attacker-controlled data be treated as trusted structures. Reported by Red Hat and tracked upstream in GNOME's GIMP tracker; SSVC lists a proof-of-concept, though it is not in CISA KEV and EPSS exploitation probability is low (0.31%).
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Command injection in dracut's die() error-handling function allows an unauthenticated attacker on the adjacent network, controlling a rogue DHCP server, to execute arbitrary commands as root during initramfs boot-failure recovery. The flaw exists because error messages written into emergency hook shell scripts under the initramfs environment are not shell-quoted, and those messages can carry attacker-controlled data sourced from the DHCP ROOT_PATH option processed by the 40network module. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploitation primitive is conceptually straightforward for anyone with DHCP server control on the local network segment.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.
Heap-buffer-overflow vulnerabilities in GIMP's APNG file loader and DDS plug-in allow code execution when a user opens a specially crafted image file. The APNG flaw is triggered when the fcTL chunk width exceeds the IHDR width, causing pixel data to overwrite memory beyond the heap allocation; the DDS flaw stems from a bits-per-pixel mismatch in load_layer(). Both affect GIMP as packaged on Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Local privilege-relevant command injection in Performance Co-Pilot's (PCP) linux_sockets PMDA lets an authenticated user inject shell metacharacters through the network.persocket.filter metric, causing arbitrary commands to run as the PMDA user each time metrics refresh. Reported by Red Hat, it affects the pcp packages shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
Arbitrary command execution as root via udev property injection in sg3_utils when sg_inq --export parses a SCSI device with a crafted name string. Affects multiple Red Hat Enterprise Linux versions shipping sg3_utils. Publicly available exploit code exists as a proof-of-concept in the upstream fix; no active exploitation has been reported.
Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi-keyex authentication path fails to confirm that the authenticated Kerberos principal is actually authorized for the local user account being requested. An already-authenticated client holding any valid Kerberos principal in the realm can therefore log in as an arbitrary user, including potentially privileged accounts, on Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS of 8.8 reflects a straightforward, low-complexity abuse once a valid Kerberos credential is held.
Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile), consistent with an availability-only, client-side bug rather than a mass-exploited issue.
Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.
Denial of service in libcupsfilters and cups-filters (the OpenPrinting image-filtering stack bundled with Red Hat Enterprise Linux 7 through 10) allows an unauthenticated attacker to abort the CUPS image filter by submitting a specially crafted PNG print job. The PNG reader instantiates a libpng decoder without registering an error-recovery handler, so a malformed image triggers libpng's default fatal-error path and terminates the filter process, killing the in-flight print job. No public exploit identified at time of analysis; this is a print-job availability issue, not a code-execution or data-exposure flaw.
Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.3 rating and clean path to full root access make it a meaningful local escalation risk in multi-tenant virtualization estates.
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in PipeWire's PulseAudio compatibility layer lets a low-privileged process inside a confined environment such as Flatpak load an attacker-controlled library and execute arbitrary code on the host user's session. The flaw (CWE-427) is present in PipeWire as shipped in Red Hat Enterprise Linux 7, 8, 9 and 10 and carries a scope-changing CVSS 3.1 score of 8.8. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.
Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.
Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.