Red Hat Enterprise Linux (RHEL)

Red Hat Hivex OOB Read via Malformed Registry Hive
CVE-2026-120740 2 - Low - November 02, 2026

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).

Out-of-bounds Read

A flaw was found in json-glib
CVE-2026-120194 7.5 - High - October 31, 2026

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

Infinite Loop

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser
CVE-2026-119727 6.5 - Medium - October 30, 2026

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.

Heap-based Buffer Overflow

A flaw was found in Red Hat Enterprise Linux 9 kernel builds
CVE-2026-118593 5.9 - Medium - October 30, 2026

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

Improper Locking

Undertow ChunkReader overflow permits HTTP request smuggling
CVE-2026-91920 6.5 - Medium - October 30, 2026

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

HTTP Request Smuggling

dnsmasq DHCPv6 Hostname OOB Read on Local Network
CVE-2026-93009 4.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

Out-of-bounds Read

dnsmasq DHCP Leasequery Allows Local Network to Leak Lease Data
CVE-2026-93010 4.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

AuthZ

dnsmasq TFTP cache reuse allows malicious PXE boot
CVE-2026-93006 6.8 - Medium - October 29, 2026

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

Operation on a Resource after Expiration or Release

DNSMASQ TCP Connection Flood causing DNS Service Denial
CVE-2026-93007 5.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

Resource Exhaustion

dnsmasq DNSSEC buffer overrun, allows heap metadata overwrite
CVE-2026-93011 5.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

Memory Corruption

dnsmasq CNAME Cache Pollution via Unverified DNS Response
CVE-2026-93008 6.8 - Medium - October 29, 2026

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

Insufficient Verification of Data Authenticity

Polkit Int Underflow in Auth Agent Causing DoS
CVE-2026-85498 3.5 - Low - October 29, 2026

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

Out-of-bounds Read

A flaw was found in the iscsiuio component of open-iscsi
CVE-2026-115486 7.1 - High - October 23, 2026

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

Out-of-bounds Read

A flaw was found in GNU patch
CVE-2026-115207 5.5 - Medium - October 22, 2026

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

Directory traversal

The system certificate authority (CA) store in Red Hat products, distributed
CVE-2026-114406 6.8 - Medium - October 21, 2026

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Improper Certificate Validation

OpenSCAP Path Traversal in SDS Decompression (CVE-2026-85518)
CVE-2026-85518 6.1 - Medium - October 21, 2026

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

Directory traversal

Red Hat libmodulemd OOB Read in YAML Serialization (CVE-2026-92824)
CVE-2026-92824 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Out-of-bounds Read

Red Hat libmodulemd DoS via Unbounded Decompression Size
CVE-2026-92823 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

Data Amplification

libmodulemd DOS via unlimited nested YAML xmd recursion
CVE-2026-92822 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Stack Exhaustion

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8
CVE-2026-112177 7.3 - High - October 20, 2026

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

Incorrect Use of Privileged APIs

A flaw was found in GIMP
CVE-2026-112261 7.8 - High - October 19, 2026

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

Dangling pointer

A flaw was found in GIMP
CVE-2026-112258 7.8 - High - October 19, 2026

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

Dangling pointer

A flaw was found in GIMP
CVE-2026-112257 7.8 - High - October 19, 2026

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

Stack Overflow

A flaw was found in GIMP
CVE-2026-112260 7.1 - High - October 19, 2026

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

Out-of-bounds Read

bootc/ostree: Bypass Image Signature Validation on Reboot
CVE-2026-16460 7.4 - High - October 19, 2026

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

Insufficient Verification of Data Authenticity

Bootc SigPolicy Flaw Enables Unsigned Image Exec as Root
CVE-2026-16487 - October 19, 2026

nfs-utils rpc.statd DoS via Memory Leak
CVE-2026-89096 5.9 - Medium - October 16, 2026

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Missing Release of Resource after Effective Lifetime

Heap-based Buffer Overflow in libparted's FAT16 Resize Logic
CVE-2026-89088 5.5 - Medium - October 16, 2026

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).

Memory Corruption

Parted Heap Overflow in FAT32 Image Processing (DoS)
CVE-2026-89085 6.6 - Medium - October 16, 2026

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

Memory Corruption

A flaw was found in Nautilus
CVE-2026-111802 6.6 - Medium - October 16, 2026

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

insecure temporary file

libarchive UAF in archive_entry_copy_mac_metadata (CVE-2026-17591)
CVE-2026-17591 3.6 - Low - October 16, 2026

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

Dangling pointer

GIMP Integer Overflow in Image Decompressor Enables DoS/memory Disclosure
CVE-2026-62438 6.1 - Medium - October 16, 2026

A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.

Integer Overflow or Wraparound

GIMP file-pvr plugin integer overflow heap buf overflow
CVE-2026-62439 7 - High - October 16, 2026

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

Integer Overflow or Wraparound

libtirpc Denial of Service via Unbounded PMAPPROC_DUMP Decoding
CVE-2026-85977 5.3 - Medium - October 16, 2026

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

Excessive Platform Resource Consumption within a Loop

libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS Data
CVE-2026-85231 6.5 - Medium - October 16, 2026

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.

Allocation of Resources Without Limits or Throttling

Local DoS via fsidd assertion failure in nfs-utils
CVE-2026-89098 5.5 - Medium - October 16, 2026

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

assertion failure

A flaw was found in luksmeta
CVE-2026-111555 6 - Medium - October 16, 2026

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.

Improper Validation of Specified Index, Position, or Offset in Input

WildFly Path Traversal in take-snapshot Allows Monitor Role to Read Config
CVE-2026-84823 7.1 - High - October 15, 2026

A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.

Directory traversal

DPDK vhost-crypto Integer Overflow, Host Buffer Overrun
CVE-2026-86849 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.

Memory Corruption

DPDK nfp vDPA Driver Buffer Overflow via Excess Virtqueues
CVE-2026-86856 6.5 - Medium - October 14, 2026

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

Memory Corruption

DPDK vhost-crypto Uninitialized Next Pointer Crash in Write-Back Chain
CVE-2026-86847 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

Access of Uninitialized Pointer

DPDK vhost-crypto OOB Write via Unchecked Avail-Ring Index
CVE-2026-86846 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.

Memory Corruption

DPDK vhost-crypto Use-after-Free via stale session pointer
CVE-2026-86845 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.

Dangling pointer

DPDK lib/vhost RX Descriptor Underflow Causes VDS in OVSDPDK
CVE-2026-86566 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

Integer underflow

DPDK lib/vhost vhost-crypto Indirect-Descriptor OOB via double-fetch
CVE-2026-86848 8.8 - High - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

TOCTTOU

DPDK lib/vhost UAF via IOTLB miss leading to use-after-unmap
CVE-2026-86567 8.8 - High - October 14, 2026

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

Dangling pointer

DPDK lib/vhost OOB write via virtqueue size desync
CVE-2026-86565 8.2 - High - October 14, 2026

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

Memory Corruption

DPDK vhost double-offset bug causes memory access error
CVE-2026-86563 7.8 - High - October 14, 2026

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

Incorrect Calculation of Buffer Size

DPDK VHOST TOCTOU Double-Fetch Heap Overflow Vulnerability
CVE-2026-86562 7.8 - High - October 14, 2026

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

Race Condition

DPDK vhost mmap size validation flaw leads to host crash
CVE-2026-86561 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.

Allocation of Resources Without Limits or Throttling