CVE-2026-103963

Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 2 more

CVE-2026-108472

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-124746

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more

CVE-2026-85518

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openscap Red Hat Redhat

Products

Openscap Enterprise Linux Enterprise Linux and 3 more

CVE-2026-124744

Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 2 more

CVE-2026-122056

Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openscap Red Hat Redhat

Products

Openscap Enterprise Linux Enterprise Linux and 3 more

CVE-2026-100229

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check

No standard GStreamer pipeline element invokes the vulnerable parser API. Exploitation would require a third-party application to call it with attacker-controlled H.266 DCI data.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux

CVE-2026-115207

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 3 more

CVE-2026-121629

Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling

A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 1 more

CVE-2026-119528

Gimp: gimp: stack buffer overflow in psd image resource header loader

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els and 1 more

CVE-2026-109832

Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Eus

CVE-2025-11395

Podman: arbitrary file write when importing oci archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 6 more

CVE-2026-119777

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 1 more

CVE-2026-86564

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Dpdk Red Hat Redhat

Products

Dpdk Enterprise Linux Fast Datapath For Rhel 10 and 5 more

CVE-2026-85013

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 3 more

CVE-2026-86476

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 1 more

CVE-2026-86320

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 5 more

CVE-2026-86566

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dpdk Red Hat Redhat

Products

Dpdk Enterprise Linux Enterprise Linux and 3 more

CVE-2026-86561

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dpdk Red Hat Redhat

Products

Dpdk Enterprise Linux Enterprise Linux and 5 more

CVE-2026-86567

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dpdk Red Hat Redhat

Products

Dpdk Enterprise Linux Enterprise Linux and 5 more