Red Hat Enterprise Linux (RHEL)
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Enterprise Linux (RHEL).
Recent Red Hat Enterprise Linux (RHEL) Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:46956 | (RHSA-2026:46956) Red Hat Enterprise Linux AI 3.3.5 | July 27, 2026 |
| RHSA-2026:43855 | (RHSA-2026:43855) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43853 | (RHSA-2026:43853) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43854 | (RHSA-2026:43854) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43851 | (RHSA-2026:43851) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43670 | (RHSA-2026:43670) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43651 | (RHSA-2026:43651) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:33531 | (RHSA-2026:33531) Red Hat Enterprise Linux AI 3.4.1 enhancement update | June 30, 2026 |
| RHSA-2026:33524 | (RHSA-2026:33524) Red Hat Enterprise Linux AI 3.4.1 enhancement update | June 30, 2026 |
| RHSA-2026:17611 | (RHSA-2026:17611) Red Hat Enterprise Linux AI 3.3.3 | May 14, 2026 |
By the Year
In 2026 there have been 1120 vulnerabilities in Red Hat Enterprise Linux (RHEL) with an average score of 7.1 out of ten. Last year, in 2025 Enterprise Linux (RHEL) had 213 security vulnerabilities published. That is, 907 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.60.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1120 | 7.13 |
| 2025 | 213 | 6.52 |
| 2024 | 172 | 6.36 |
| 2023 | 212 | 6.38 |
| 2022 | 176 | 6.72 |
| 2021 | 148 | 6.50 |
| 2020 | 104 | 6.35 |
| 2019 | 293 | 6.21 |
| 2018 | 113 | 7.02 |
It may take a day or so for new Enterprise Linux (RHEL) vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Enterprise Linux (RHEL) Security Vulnerabilities
jwcrypto General JWS Verification Bypass via Key ID Misidentification
CVE-2026-84185
5.9 - Medium
- September 03, 2026
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
Improper Verification of Cryptographic Signature
Stack Overflow in gfs2-utils Metadata Walk via untrusted inode height
CVE-2026-71224
4.7 - Medium
- September 03, 2026
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
Allocation of Resources Without Limits or Throttling
Red Hat GFS2-Utils Heap OOB Read in ea_num_ptrs
CVE-2026-71222
5.3 - Medium
- September 03, 2026
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
Out-of-bounds Read
Stack OOB Write in RedHat gfs2-utils savemeta Arbitrary Code Execution
CVE-2026-71221
7 - High
- September 03, 2026
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
Memory Corruption
Stack OOB Write in gfs2-utils (Red Hat)
CVE-2026-71220
7 - High
- September 03, 2026
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
Memory Corruption
Stack Overflow in gfs2-utils via di_depth overflow DoS
CVE-2026-71219
4.7 - Medium
- September 03, 2026
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
Allocation of Resources Without Limits or Throttling
GStreamer RTSP Digest Auth NULL Deref DoS
CVE-2026-85150
7.5 - High
- September 03, 2026
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
NULL Pointer Dereference
RedHat RPM rpmuncompress Command Injection via Unescaped Filename
CVE-2026-84838
7.8 - High
- September 02, 2026
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
Shell injection
Command Injection in rpmbuild via Path Manipulation
CVE-2026-84837
7.8 - High
- September 02, 2026
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.
Shell injection
Linux Kernel 6.15+ X-mount.subdir Symlink Traversal Local PrivEsc
CVE-2026-78409
7 - High
- September 02, 2026
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.
insecure temporary file
util-linux Local Privilege Escalation via Redirected Restricted Bind Mount
CVE-2026-78410
7.8 - High
- September 02, 2026
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
TOCTTOU
CVE-2026-78408: nsenter --join-cgroup root-FD leak allows cgroup migration
CVE-2026-78408
7.9 - High
- September 02, 2026
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
Missing Release of File Descriptor or Handle after Effective Lifetime
Red Hat Password_Reset Unvalidated Redirect
CVE-2026-53683
4.3 - Medium
- September 02, 2026
reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.
Open Redirect
GVFS MTP Backend DoS via unchecked memcpy
CVE-2026-84270
4.3 - Medium
- September 01, 2026
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
Out-of-bounds Read
gvfs AFP backend heap overflow causing DoS
CVE-2026-84269
6.5 - Medium
- September 01, 2026
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
Heap-based Buffer Overflow
GVFS SFTP Backend Buffer Uninitialized Leak Enables ASLR Bypass
CVE-2026-84267
4.3 - Medium
- September 01, 2026
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap contents. If the server sends a short FXP_HANDLE reply, these uninitialized bytes are taken as the file handle. The client will then echo these uninitialized bytes back to the server on all subsequent requests using that handle. With a length of 128 bytes, this issue allows the malicious server to deterministically read uninitialized heap memory from the gvfsd-sftp process, leaking its heap base and the load address of the libgio library, resulting in a deterministic defeat of Address Space Layout Randomization (ASLR).
Use of Uninitialized Resource
GVFS SFTP Backend Buffer Overflow in read_reply()
CVE-2026-84268
8.8 - High
- September 01, 2026
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Heap-based Buffer Overflow
Local Command Execution via Macro Expansion in rpm's rpmuncompress
CVE-2026-84233
7 - High
- September 01, 2026
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Shell injection
Red Hat Unauth Query of Security Domain Hosts via /ca/rest API
CVE-2026-53682
5.3 - Medium
- September 01, 2026
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
Information Disclosure
Red Hat Dogtag CA Log Amplification via Unauth Stacktrace Leak
CVE-2026-11873
6.5 - Medium
- September 01, 2026
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.
Generation of Error Message Containing Sensitive Information
popt ConfigFileToString Realloc Heap Corruption (CVE-2026-18743)
CVE-2026-18743
2.5 - Low
- September 01, 2026
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).
Incorrect Calculation of Buffer Size
WebKitGTK Memory Corruption via Malicious Web Content
CVE-2026-83596
8.8 - High
- August 31, 2026
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
Classic Buffer Overflow
GDB STABS Debug Format Parser Buffer Overflow in read_member_functions
CVE-2026-13732
7.8 - High
- August 31, 2026
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
Memory Corruption
XXE in RESTEasy SourceProvider Enables Remote File Read
CVE-2026-17615
7.5 - High
- August 31, 2026
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
XXE
Undertow WebSocket Config Overflow Allows Memory Exhaustion Remote DOS
CVE-2026-81624
7.5 - High
- August 31, 2026
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
Allocation of Resources Without Limits or Throttling
GIMP file-psd plugin heap OOB read/stack OOB access CVE-2026-82343
CVE-2026-82343
6.1 - Medium
- August 28, 2026
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
Classic Buffer Overflow
GIMP file-pvr VQ Decoder OOB Heap Read DoS/Info Disclosure
CVE-2026-82330
6.1 - Medium
- August 28, 2026
A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
Out-of-bounds Read
GIMP file-ico Plugin Heap OOB Read in ICO Processing
CVE-2026-82328
6.1 - Medium
- August 28, 2026
A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
Out-of-bounds Read
OOB Write in libsolv .solv Cache Rewrite Causing DoS
CVE-2026-82327
5.5 - Medium
- August 28, 2026
A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.
out-of-bounds array index
GIMP IFF/ILBM Plugin Heap OOB Read via HAM Row Size
CVE-2026-82324
6.1 - Medium
- August 28, 2026
A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
Out-of-bounds Read
jwcrypto JWE Deserialization Memory Overrun DoS
CVE-2026-80179
5.9 - Medium
- August 27, 2026
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Allocation of Resources Without Limits or Throttling
gdk-pixbuf 2.26.4+ OOB Write via Malformed JPEG ICC Profile
CVE-2026-81893
4.7 - Medium
- August 27, 2026
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4
Memory Corruption
Undertow WebSocket DoS via PerMessageDeflate Buffer Doubling
CVE-2026-5680
7.5 - High
- August 27, 2026
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
Allocation of Resources Without Limits or Throttling
rsyslog RainerScript replace() Heap Overflow (DoS)
CVE-2026-78002
7.5 - High
- August 27, 2026
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
Incorrect Calculation of Buffer Size
Unbounded VLA stack allocation in GIMP's Seattle FilmWorks plugin
CVE-2026-79902
5.5 - Medium
- August 26, 2026
A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.
Integer Overflow or Wraparound
BlueZ sdp-xml.c Type Confusion in RegisterProfile() leads to Local DoS
CVE-2026-80185
5.7 - Medium
- August 25, 2026
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Object Type Confusion
BlueZ stack-based buffer overflow via crafted EIR packet (DoS/Arbitrary exec)
CVE-2026-80186
7.6 - High
- August 25, 2026
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
Classic Buffer Overflow
Heap OOB Read in GIMP file-xwd Plugin (Image Width/Bytes-Per-Line Validation)
CVE-2026-80101
4.4 - Medium
- August 25, 2026
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.
Out-of-bounds Read
LibSoup O(N2) Range Header CPU Exhaustion
CVE-2026-77680
5.3 - Medium
- August 25, 2026
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907
Inefficient Algorithmic Complexity
Emacs TRAMP Local Exec via Malformed Filenames
CVE-2026-79992
7.8 - High
- August 25, 2026
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.
Shell injection
Sos Clean Path Traversal Enables Arbitrary File Creation with Root Privileges
CVE-2026-79655
7.8 - High
- August 25, 2026
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.
insecure temporary file
389-ds Base SASL UNBIND DoS via Remote Authenticated Stalling
CVE-2026-78701
6.5 - Medium
- August 25, 2026
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server.
Memory Corruption
File-roller Stack Buffer Overflow via Malicious Archive Path
CVE-2026-78322
6.5 - Medium
- August 25, 2026
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
Classic Buffer Overflow
Unbounded Stack Allocation in GIMP file-pix (ESM) Plugin
CVE-2026-78475
6.1 - Medium
- August 24, 2026
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.
Out-of-bounds Read
Heap-Based Buffer Overflow in GIMP file-pcx Plugin (32bit)
CVE-2026-78465
7 - High
- August 24, 2026
A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Integer Overflow or Wraparound
NetworkManager Vulnerable 802-1x.ca-path CA Path Bypass (CVE-2026-19685)
CVE-2026-19685
9.8 - Critical
- August 24, 2026
NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.
AuthZ
rpmbuild Macro Injection via Tar Member Name
CVE-2026-78367
7 - High
- August 24, 2026
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).
Code Injection
WebKitGTK UAF via improper memory handling in WebKitGTK
CVE-2026-78376
8.8 - High
- August 24, 2026
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
Dangling pointer
Trust Anchor Validation Flaw in JSS JSSTrustManager
CVE-2026-78323
6.5 - Medium
- August 24, 2026
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.
Improper Certificate Validation
Null Pointer Deref in FreeIPA ipa-enrollment SLAPI (DoS)
CVE-2026-73199
6.5 - Medium
- August 20, 2026
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
NULL Pointer Dereference
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Enterprise Linux (RHEL) or by Red Hat? Click the Watch button to subscribe.
