Red Hat Enterprise Linux (RHEL)

SSSD Local OOB Read via Unvalidated Auth Token
CVE-2026-68743 5.5 - Medium - August 04, 2026

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

Out-of-bounds Read

Stunnel s_vlog OOB stack read via oversized log message
CVE-2026-70368 6.5 - Medium - August 04, 2026

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

Out-of-bounds Read

Stunnel 5.79 SSRF Bypass via IPv6 -> Localhost via SOCKS Proxy
CVE-2026-70367 5.4 - Medium - August 04, 2026

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

SSRF

popt Off-by-One Vulnerability Allows Local Exec
CVE-2026-18739 2.5 - Low - August 04, 2026

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

Memory Corruption

Red Hat SSSD NSS Preallocation Leak Exposes Heap Data
CVE-2026-68744 3.3 - Low - August 04, 2026

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

Use of Uninitialized Resource

GIMP APNG/DDS Loader Heap Buffer Overflow
CVE-2026-42169 7.3 - High - August 04, 2026

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

Incorrect Calculation of Buffer Size

TOCTOU in GNU tar incremental dumpdir rename
CVE-2026-18477 4.4 - Medium - August 03, 2026

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflowsincluding extracting into a newly created directory without using the -P option do not mitigate the issue.

TOCTTOU

389 Directory Server Auth Bypass via SASL PLAIN & Account Lock Defect
CVE-2026-18651 5.4 - Medium - August 03, 2026

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

authentification

GNU tar Hardlink Extraction Path Traversal via --one-top-level
CVE-2026-18508 4.4 - Medium - August 03, 2026

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

insecure temporary file

SSSD NSS Responder OOB Read via GETHOSTBYADDR Causing DoS
CVE-2026-68742 5.5 - Medium - August 03, 2026

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

Out-of-bounds Read

GIMP PAA decode_lzss Heap OOB RCE
CVE-2026-6695 5.5 - Medium - August 03, 2026

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

Buffer Access with Incorrect Length Value

GIMP file-png Plugin Stack Overflow via Malicious APNG tRNS Chunk
CVE-2026-6694 5.5 - Medium - August 03, 2026

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

Classic Buffer Overflow

Red Hat GNOME-Remote-Desktop RDP Connection Throttle Bypass
CVE-2026-18358 7.5 - High - July 31, 2026

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.

Resource Exhaustion

389 DS LDAP Filter Injection via CleanAllRUV Replication Status-Check
CVE-2026-11770 7.5 - High - July 31, 2026

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

LDAP Injection

389 DS LDAP: Stack Buffer Overflow in get_ruvelement_from_berval
CVE-2026-15722 7.5 - High - July 31, 2026

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

Stack Overflow

Yggdrasil-WP Manager: Argument Injection in APT Backend Allows Root RCE
CVE-2026-18157 7.8 - High - July 31, 2026

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability.

Argument Injection

Leapp Collection: Insecure PG Backup Archive Permissions Leak Info
CVE-2026-68563 5.5 - Medium - July 30, 2026

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

Incorrect Permission Assignment for Critical Resource

RedHat Ansible Leapp Report Manipulation Exposes Controller Files
CVE-2026-68562 6.2 - Medium - July 30, 2026

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.

Externally Controlled Reference to a Resource in Another Sphere

Samba KDC kpasswd OOB Read in ASN.1 Authenticated DoS
CVE-2026-58216 5.3 - Medium - July 30, 2026

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.

Out-of-bounds Read

LDAP Filter Injection & PrivEsc in Samba AD DC
CVE-2026-58222 8.8 - High - July 30, 2026

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

LDAP Injection

Samba DNS TKEY Cache DoS via Unauth Reg
CVE-2026-58218 5.3 - Medium - July 30, 2026

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

Insufficient Resource Pool

Dogtag PKI ACME Responder SSRF via IP literals & redirects
CVE-2026-18369 5.8 - Medium - July 30, 2026

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

SSRF

RedHat PCP pmproxy Servlet Path Traversal VULN
CVE-2026-16531 5.3 - Medium - July 30, 2026

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Directory traversal

Remote DoS via Bounds Check Bypass in PCP pmproxy (pmLogLoadInDom)
CVE-2026-16530 6.5 - Medium - July 30, 2026

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Out-of-bounds Read

Red Hat PCP __pmGetPDU Integer Overflow DoS
CVE-2026-16529 7.5 - High - July 30, 2026

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

Integer Overflow or Wraparound

Unauth RCE via PCP pmproxy /store (CVE-2026-16527)
CVE-2026-16527 7.3 - High - July 30, 2026

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Authorization

PCP linux_sockets Module Exposes Unsecured Connection for Privilege Escalation
CVE-2026-16526 8.8 - High - July 30, 2026

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

File descriptor leak

Command Injection in PCP linux_sockets PMDA via network.persocket.filter
CVE-2026-16524 7.8 - High - July 30, 2026

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

Shell injection

GNU binutils BFD DLX ELF Backend OOB Write (CVE-2026-18220)
CVE-2026-18220 7.8 - High - July 29, 2026

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation type number space is non-contiguous (basic types 0-6, extended types at 0x10000+), but the default case in the switch statement allows arbitrary index values to reach the array access. A specially crafted ELF/DLX object file can trigger this out-of-bounds write when processed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The vulnerability has been demonstrated to achieve arbitrary code execution via a File Stream Oriented Programming (FSOP) attack against glibc FILE structures (stderr), redirecting control flow to system(). Attack scenarios include CI/CD pipelines performing automated binary analysis, developer workstations running objdump/readelf on untrusted binaries, automated security scanning or malware analysis tools invoking binutils, and package build systems processing third-party code. Note: This vulnerability is only exploitable when binutils is built with the DLX backend enabled (typically via --enable-targets=all).

Memory Corruption

CRIU rseq Credential Spo via Checkpoint/Restore
CVE-2026-18107 7.8 - High - July 28, 2026

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited by several factors: checkpoint/restore requires root privileges (podman) or cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from within the container itself; on OpenShift prior to 4.17 the feature required explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not configured by default; OpenShift enforces user namespaces by default for regular workloads (hostUsers is gated behind admin-only SCCs), which makes the spoofed capabilities namespace-scoped and ineffective for privilege escalation; SELinux type enforcement (container_t) blocks privilege transitions independently of capabilities; seccomp filters persist through checkpoint/restore and cannot be corrupted via the parasite; and kernel mount namespace ownership checks on RHEL 9/10 kernels prevent mount-based container escape even with spoofed capabilities.

Improper Privilege Management

Red Hat sg3_utils: sg_inq --export Control Characters Leak
CVE-2026-16313 7.6 - High - July 28, 2026

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

CRLF Injection

Dogtag PKI ACME Responder Admin Bypass via URL Trailing Slash
CVE-2026-18047 6.5 - Medium - July 28, 2026

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.

Authentication Bypass Using an Alternate Path or Channel

gstreamer gst-plugins-good FLAC-Matroska OOB heap read
CVE-2026-17072 3.3 - Low - July 28, 2026

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

Out-of-bounds Read

GIMP icns_plugin OOB Read leaks heap via truncated mask
CVE-2026-66759 7.1 - High - July 27, 2026

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.

Out-of-bounds Read

GIMP file-fits plugin int32 overflow -> heap BO
CVE-2026-66758 7.8 - High - July 27, 2026

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

Integer Overflow or Wraparound

GIMP file-sgi Plugin: RLE Header Integer Overflows DoS
CVE-2026-66757 5.5 - Medium - July 27, 2026

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

Integer Overflow or Wraparound

GNU Binutils Linker Heap Buffer Overflow in XCOFF
CVE-2026-15003 5.6 - Medium - July 27, 2026

A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing.

Out-of-bounds Read

Red Hat Kernel Local Privilege Escalation CVE-2026-17523
CVE-2026-17523 7.8 - High - July 27, 2026

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.

Dangling pointer

Heap Over-Read in Libsoup via Unsigned Underflow
CVE-2026-66337 6.5 - Medium - July 24, 2026

A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.

Out-of-bounds Read

libsoup Chunked Encoding Parser Permissive RFT Exploit
CVE-2026-66338 5.4 - Medium - July 24, 2026

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

HTTP Request Smuggling

libsoup Proxy-Auth Header leakage via CONNECT tunnel
CVE-2026-66339 6.5 - Medium - July 24, 2026

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

Insertion of Sensitive Information Into Sent Data

Red Hat pki-core Missing Realm Auth on CA Renewal (CVE202617039)
CVE-2026-17039 3.1 - Low - July 24, 2026

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.

AuthZ

Local File Read via systemd-homed in accountsservice
CVE-2026-16743 5.5 - Medium - July 24, 2026

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.

Improper Privilege Management

dbus-broker DoS via FD exhaustion causing fatal broker exit
CVE-2026-16730 5.5 - Medium - July 24, 2026

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

Improper Handling of Exceptional Conditions

Out-of-Memory Crash via TLS Endpoint in RHCS (Java)
CVE-2026-12353 5.3 - Medium - July 23, 2026

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary.

Missing Release of Resource after Effective Lifetime

OOB Read in gdk-pixbuf ICO Parsing
CVE-2026-16768 5.3 - Medium - July 23, 2026

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.

Out-of-bounds Read

libcupsfilters Infinite Loop DoS via IEEE-1284 Printer ID
CVE-2026-64611 7.5 - High - July 23, 2026

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.

Infinite Loop

GNU nano multi-buffer format string vulnerability
CVE-2026-6390 6.8 - Medium - July 23, 2026

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Use of Externally-Controlled Format String

Red Hat librest PKCE GRand PRNG flaw
CVE-2026-16615 6.8 - Medium - July 22, 2026

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

PRNG

CVE-2026-16552: systemdtmpfiles Symlink Spoofing (Integrity)
CVE-2026-16552 - July 22, 2026