CVE-2026-119777

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 1 more

CVE-2026-95619

Gcc: libstdc++ integer overflow in `new` operator

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 5 more

CVE-2026-102010

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gcc Enterprise Linux Enterprise Linux Eus and 7 more

CVE-2026-96280

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-91147

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Dev Spaces Openshift Devspaces and 1 more

CVE-2026-76235

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Dev Spaces Openshift Devspaces and 1 more

CVE-2026-85013

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 3 more

CVE-2026-86476

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 1 more

CVE-2026-96275

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-88924

Gvfs: gvfs-admin socket ownership race permits local root

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gvfs Enterprise Linux Enterprise Linux Eus and 3 more

CVE-2026-84268

Gvfs: sftp: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 5 more

CVE-2026-91149

Cockpit: cockpit: denial of service via unbounded connection thread spawning

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Dev Spaces Openshift Devspaces and 1 more

CVE-2026-97024

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Enterprise Linux Eus and 3 more

CVE-2026-97023

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Enterprise Linux Eus and 3 more

CVE-2026-74860

Libxml2: double-free/uaf in libxml2 python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cert Manager Cost Management On Premise Enterprise Linux and 13 more

CVE-2026-97185

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel E4s and 1 more

CVE-2026-92248

Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gnome Red Hat Redhat

Products

Gimp Enterprise Linux Enterprise Linux and 2 more

CVE-2026-90948

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gimp Red Hat Redhat

Products

Gimp Enterprise Linux Enterprise Linux and 2 more

CVE-2026-90947

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gnome Red Hat Redhat

Products

Gimp Enterprise Linux Enterprise Linux and 2 more

CVE-2026-85234

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hummingbird Rhel Els