CVE-2026-124746

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more

CVE-2026-85518

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openscap Red Hat Redhat

Products

Openscap Enterprise Linux Enterprise Linux and 3 more

CVE-2026-119618

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation Redhat

Products

Apache Http Server Http Server Apache Http Server and 4 more

CVE-2026-124744

Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 2 more

CVE-2026-16118

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Cert Manager Cost Management On Premise and 10 more

CVE-2026-122056

Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openscap Red Hat Redhat

Products

Openscap Enterprise Linux Enterprise Linux and 3 more

CVE-2026-125707

Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-125706

Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-125703

Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-91151

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Openshift Devspaces and 2 more

CVE-2026-91150

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Openshift Devspaces and 2 more

CVE-2026-84837

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 2 more

CVE-2026-78367

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hummingbird Openshift Ai and 1 more

CVE-2026-100229

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check

No standard GStreamer pipeline element invokes the vulnerable parser API. Exploitation would require a third-party application to call it with attacker-controlled H.266 DCI data.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux

CVE-2026-84838

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 1 more

CVE-2026-84233

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 1 more

CVE-2026-55655

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd Openssh Redhat

Products

Openssh Openssh Enterprise Linux and 12 more

CVE-2026-55653

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd Openssh Redhat

Products

Openssh Openssh Enterprise Linux and 12 more

CVE-2026-13595

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kernel Linux Redhat

Products

Util-linux Util-linux Cost Management On Premise and 8 more

CVE-2026-96541

Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gnome-remote-desktop Enterprise Linux Enterprise Linux Eus and 1 more