Red Hat Hummingbird

Polkit Int Underflow in Auth Agent Causing DoS
CVE-2026-85498 3.5 - Low - October 29, 2026

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

Out-of-bounds Read

OpenSCAP Path Traversal in SDS Decompression (CVE-2026-85518)
CVE-2026-85518 6.1 - Medium - October 21, 2026

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

Directory traversal

Red Hat libmodulemd OOB Read in YAML Serialization (CVE-2026-92824)
CVE-2026-92824 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Out-of-bounds Read

Red Hat libmodulemd DoS via Unbounded Decompression Size
CVE-2026-92823 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

Data Amplification

libmodulemd DOS via unlimited nested YAML xmd recursion
CVE-2026-92822 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Stack Exhaustion

bootc/ostree: Bypass Image Signature Validation on Reboot
CVE-2026-16460 7.4 - High - October 19, 2026

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

Insufficient Verification of Data Authenticity

Bootc SigPolicy Flaw Enables Unsigned Image Exec as Root
CVE-2026-16487 - October 19, 2026

libarchive UAF in archive_entry_copy_mac_metadata (CVE-2026-17591)
CVE-2026-17591 3.6 - Low - October 16, 2026

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

Dangling pointer

libtirpc Denial of Service via Unbounded PMAPPROC_DUMP Decoding
CVE-2026-85977 5.3 - Medium - October 16, 2026

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

Excessive Platform Resource Consumption within a Loop

libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS Data
CVE-2026-85231 6.5 - Medium - October 16, 2026

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.

Allocation of Resources Without Limits or Throttling

BusyBox dpkg write_status_file cursor reset flaw causes data corruption
CVE-2026-88842 3.3 - Low - October 14, 2026

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

Out-of-bounds Read

BusyBox httpd Reverse Proxy Path Bypass via Pipelined Requests
CVE-2026-88829 7.2 - High - October 14, 2026

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

HTTP Request Smuggling

BusyBox dpkg-deb Symlink Injection via .deb Extraction
CVE-2026-90954 7.8 - High - October 14, 2026

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

insecure temporary file

BusyBox httpd Username Enumeration via System Password Auth
CVE-2026-88834 3.7 - Low - October 13, 2026

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

Side Channel Attack

BusyBox Mount Bypass via Clearing-Mask Options
CVE-2026-88838 5.5 - Medium - October 13, 2026

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

Protection Mechanism Failure

BusyBox udhcpc DHCP Client Integer Underflow DoS
CVE-2026-88833 6.5 - Medium - October 13, 2026

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

Integer underflow

FreeType CID Font Loader Memory DoS via Repeated Allocations
CVE-2026-95512 5.5 - Medium - October 02, 2026

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

Resource Exhaustion

Heap Buffer Overflow in rpm via Symlink Entry Parsing
CVE-2026-95520 7.1 - High - September 29, 2026

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

Memory Corruption

Command Injection via %() Macro in rpm SRPM
CVE-2026-95521 7.8 - High - September 24, 2026

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Shell injection

CVE-2026-95519: rpm manifest macro exp. allows RCE
CVE-2026-95519 7.8 - High - September 24, 2026

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

Shell injection

BusyBox TLS get_client_hello() OOB Read on Truncated ClientHello
CVE-2026-88840 5.3 - Medium - September 23, 2026

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

Out-of-bounds Read

OOB Heap Write in BusyBox passwd/group tokenize()
CVE-2026-88839 6.7 - Medium - September 23, 2026

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

Memory Corruption

BusyBox httpd Basic Auth Inverts Yescrypt Hash Check
CVE-2026-88837 6.5 - Medium - September 23, 2026

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

Authentication Bypass by Primary Weakness

BusyBox dpkg read_package_field() OOB Heap Read via Malformed .deb
CVE-2026-88835 6.1 - Medium - September 23, 2026

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

Out-of-bounds Read

BusyBox httpd IP Deny Rule Fail-Open via Invalid CIDR Prefix Length
CVE-2026-88831 5.3 - Medium - September 23, 2026

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

Failing Open

BusyBox romfs Volume ID Parsing Heap Buffer Overflow via Unbounded Strlen
CVE-2026-88832 7.3 - High - September 23, 2026

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

Memory Corruption

BusyBox TLS Heap Overflow via ClientKeyExchange (CVE-2026-88830)
CVE-2026-88830 7.5 - High - September 23, 2026

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Incorrect Calculation of Buffer Size

sudo Time Window Bypass via TZ in NOTBEFORE/NOTAFTER
CVE-2026-96512 7.8 - High - September 23, 2026

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

AuthZ

Integer Overflow in libstdc++ New Operator Causing Memory Corruption
CVE-2026-95619 7.7 - High - September 22, 2026

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.

Integer Overflow or Wraparound

CUPS Privilege Escalation via cupsfilters Serial Backend Path Bypass
CVE-2026-95511 - September 22, 2026

DenialofService in Poppler Splash via tilingpattern overflow
CVE-2026-93653 5.5 - Medium - September 18, 2026

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.

Unchecked Input for Loop Condition

libxml2 NULL Pointer Deref in XML Catalog Parsing (DoS)
CVE-2026-76781 5.5 - Medium - September 17, 2026

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).

NULL Pointer Dereference

Redis Community Cluster Bus OOB Read via Unchecked Null-Termination
CVE-2026-92925 7.1 - High - September 17, 2026

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

Out-of-bounds Read

sequoia-openpgp Key Flag Flaw Allows Subkey Bypass & Signature Forgery
CVE-2026-42784 7.4 - High - September 16, 2026

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Improper Verification of Cryptographic Signature

Podman tar load RCE: crafted archive writes files with user privileges
CVE-2025-11395 5.5 - Medium - September 15, 2026

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

Insecure Inherited Permissions

tftp-hpa OOB Read/Write via Malicious Inverse Remap Rule
CVE-2026-85234 7.5 - High - September 15, 2026

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Out-of-bounds Read

containers/storage: Arbitrary File Overwrite via Malicious Whiteout Header
CVE-2026-79699 4.4 - Medium - September 15, 2026

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

insecure temporary file

Buildah Copier Go Package Symlink Extraction Escape (CVE-2026-79705)
CVE-2026-79705 4.5 - Medium - September 15, 2026

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Directory traversal

EnvModules Local Cmd Injection via Bash Completion
CVE-2026-85013 7.3 - High - September 15, 2026

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Shell injection

libtiff tiff2pdf Heap-BUF Overflow via Truncated StripByteCounts
CVE-2026-18495 6.1 - Medium - September 11, 2026

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Heap-based Buffer Overflow

CVE-2026-88265: crun 1.29.1 and below pivot_root stdio symlink issue
CVE-2026-88265 5.6 - Medium - September 10, 2026

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

insecure temporary file

crun 1.29.1: /dev Console Redirect via Terminal Setup Insecure Bind-Mount
CVE-2026-88264 5.6 - Medium - September 10, 2026

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

insecure temporary file

crun 1.29+ Priv Esc via PassNet (libkrun)
CVE-2026-84042 7.8 - High - September 10, 2026

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Improper Privilege Management

CUPS Username ACL Bypass via Case-Insensitive Comparisons
CVE-2026-87876 3 - Low - September 09, 2026

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Improper Handling of Case Sensitivity

CUPS UTF32ToUTF8 Heap OOB Read via SNMP
CVE-2026-87875 4.3 - Medium - September 09, 2026

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Out-of-bounds Read

Bubblewrap <0.12.0: Symlink Escape via /oldroot During Sandbox Setup
CVE-2026-87766 8.8 - High - September 09, 2026

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

insecure temporary file

libxml2 Python SAX Binding Double-Free DoS CVE-2026-74860
CVE-2026-74860 8.5 - High - September 08, 2026

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Release of Invalid Pointer or Reference

Race Condition in GLib2 g_file_replace() Enables File Redirect
CVE-2026-86469 5.3 - Medium - September 07, 2026

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.

insecure temporary file

RedHat RPM rpmuncompress Command Injection via Unescaped Filename
CVE-2026-84838 7.8 - High - September 02, 2026

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

Shell injection

Command Injection in rpmbuild via Path Manipulation
CVE-2026-84837 7.8 - High - September 02, 2026

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.

Shell injection