CVE-2026-90995

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Red Hat Redhat and 1 more

Products

Sssd Enterprise Linux Enterprise Linux and 4 more

CVE-2026-90996

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Red Hat Redhat and 1 more

Products

Sssd Enterprise Linux Enterprise Linux and 4 more

CVE-2026-91786

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-91926

Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challenge

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux

CVE-2026-79705

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Red Hat Quay 3 Ansible Automation Platform and 12 more

CVE-2026-79699

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Red Hat Quay 3 Ansible Automation Platform and 12 more

CVE-2026-92382

Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-102474

Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Dash Red Hat Redhat

Products

Dash Enterprise Linux Enterprise Linux and 1 more

CVE-2026-4897

Polkit: polkit: denial of service via unbounded input processing through standard input

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop Redhat

Products

Polkit Enterprise Linux Hummingbird and 3 more

CVE-2026-124882

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus

CVE-2026-124881

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus

CVE-2026-124876

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus

CVE-2026-18103

Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dhcp-server Redhat

Products

Dhcp-server Enterprise Linux Rhel Els

CVE-2026-16530

Pcp: pcp: remote denial of service and information leakage

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform and 1 more

CVE-2026-58014

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 15 more

CVE-2026-58015

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 15 more

CVE-2026-58013

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 14 more

CVE-2026-58012

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 14 more

CVE-2026-58016

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Cert-manager Operator Cert Manager and 22 more

CVE-2026-58011

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Ai Inference Server Cert Manager and 14 more