CVE-2025-7425

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cert Manager Discovery Enterprise Linux and 14 more

CVE-2026-10118

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Enterprise Linux Enterprise Linux Eus and 9 more

CVE-2026-10649

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Clusterlabs Redhat

Products

Pacemaker Enterprise Linux Enterprise Linux Eus and 8 more

CVE-2025-48798

Gimp: multiple use after free in xcf parser

A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2025-48797

Gimp: multiple heap buffer overflows in tga parser

A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2025-4404

Freeipa: idm: privilege escalation from host to domain admin in freeipa

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

CVSS 3.1 · 9.1 Critical EPSS 2.0% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2025-49796

Libxml: type confusion leads to denial of service (dos)

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Cert Manager Discovery Enterprise Linux and 13 more

CVE-2025-49794

Libxml: heap use after free (uaf) leads to denial of service (dos)

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Cert Manager Enterprise Linux and 13 more

CVE-2025-49180

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension

A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2025-49179

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension

A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2025-49177

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els Rhel Eus

CVE-2025-49176

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2025-49175

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2025-26601

Xorg: xwayland: use-after-free in syncinittrigger()

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2025-26600

Xorg: xwayland: use-after-free in playreleasedevents()

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2025-26598

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2025-26599

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2025-26597

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2025-26596

Xorg: xwayland: heap overflow in xkbwritekeysyms()

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2025-26595

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Tigervnc X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more