CVE-2026-48914

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux For Nvidia 26 Enterprise Linux Nvidia and 3 more

CVE-2026-5121

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Libarchive Redhat

Products

Libarchive Ai Inference Server Cert Manager and 15 more

CVE-2026-5119

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Libsoup Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-4948

Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Firewalld Redhat

Products

Firewalld Enterprise Linux Enterprise Linux Eus and 5 more

CVE-2026-4887

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gimp Gnome Redhat

Products

Gimp Gimp Enterprise Linux and 6 more

CVE-2026-4647

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Hummingbird and 3 more

CVE-2026-42169

Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Enterprise Linux Eus and 3 more

CVE-2026-44604

Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 5 more

CVE-2026-43958

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel E4s and 2 more

CVE-2026-4367

Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Libxpm Projet Redhat

Products

Libxpm Enterprise Linux Hardened Images and 2 more

CVE-2026-5260

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Cert Manager Discovery and 14 more

CVE-2026-34956

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Fast Datapath Openshift and 5 more

CVE-2026-34002

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 6 more

CVE-2026-34000

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 7 more

CVE-2026-3634

Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Gnome Libsoup Redhat

Products

Libsoup Libsoup Enterprise Linux and 1 more

CVE-2026-3442

Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Hummingbird and 3 more

CVE-2026-3441

Binutils: gnu binutils: information disclosure via specially crafted xcoff object file

A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Hummingbird and 3 more

CVE-2026-18495

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ceph Storage Enterprise Linux Hummingbird and 1 more

CVE-2026-28296

Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-3099

Libsoup: libsoup: authentication bypass via digest authentication replay attack

A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Libsoup Redhat

Products

Libsoup Libsoup Enterprise Linux and 1 more