CVE-2025-12748

Libvirt: denial of service in xml parsing

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2025-12464

Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2025-12105

Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion

A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel Els

CVE-2024-45779

Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser

An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Enterprise Linux Openshift and 1 more

CVE-2024-45778

Grub2: fs/bfs: integer overflow in the bfs parser.

A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Enterprise Linux Openshift and 2 more

CVE-2024-45777

Grub2: grub-core/gettext: integer overflow leads to heap oob write.

A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Enterprise Linux Openshift and 1 more

CVE-2024-45776

Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.

When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2024-45774

Grub2: reader/jpeg: heap oob write during jpeg parsing

A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2024-45775

Grub2: commands/extcmd: missing check for failed allocation

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2024-45770

Pcp: pmpost symlink attack allows escalating pcp to root user

A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2024-45769

Pcp: pmcd heap corruption through metric pmstore operations

A vulnerability was found in Performance Co-Pilot (PCP).  This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2024-4418

Libvirt: stack use-after-free in virnetclientioeventloop()

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Rhel Els and 1 more

CVE-2024-52615

Avahi: avahi wide-area dns uses constant source port

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2024-52616

Avahi: avahi wide-area dns predictable transaction ids

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2024-52337

Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 6 more

CVE-2024-56827

Openjpeg: heap buffer overflow in lib/openjp2/j2k.c

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2024-56826

Openjpeg: heap buffer overflow in bin/common/color.c

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2024-49393

Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mutt Neomutt Redhat

Products

Mutt Neomutt Enterprise Linux and 1 more

CVE-2024-27834

webkit: pointer authentication bypass

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Listed

Vendors

Apple Fedoraproject Redhat and 2 more

Products

Ipados Iphone Os Macos and 8 more

CVE-2024-45783

Grub2: fs/hfs+: refcount can be decremented twice

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els