CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-93006

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-92821

Sssd: sssd: access control bypass via premature ldap access rule evaluation

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Sssd

Products

Enterprise Linux Openshift Openshift Container Platform and 2 more

CVE-2026-91920

Undertow: undertow: chunkreader message length permits chunk-size overflow

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Camel Spring Boot Enterprise Linux Jboss Enterprise Application Platform and 3 more

CVE-2026-90462

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Sssd

Products

Sssd Enterprise Linux Openshift and 3 more

CVE-2026-82324

Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0

A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Els

CVE-2026-75032

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-89329

Device-mapper-multipath: local denial of service via blocking ipc send operations

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform and 1 more

CVE-2026-89098

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nfs Redhat

Products

Nfs-utils Enterprise Linux Openshift and 2 more

CVE-2026-89096

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nfs Redhat

Products

Nfs-utils Enterprise Linux Openshift and 2 more

CVE-2026-89088

Parted: parted: denial of service via heap buffer overflow during fat16 resize

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gparted Redhat

Products

Gparted Enterprise Linux Rhel Els

CVE-2026-89085

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gparted Redhat

Products

Gparted Enterprise Linux Rhel Els

CVE-2026-88914

Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-88859

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-88265

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 1 more

CVE-2026-88264

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Containers Redhat

Products

Crun Enterprise Linux Hardened Images and 2 more

CVE-2026-88252

Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Sssd

Products

Sssd Enterprise Linux Openshift and 3 more

CVE-2026-87875

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openprinting Redhat

Products

Cups Enterprise Linux Hardened Images and 4 more

CVE-2026-86345

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Enterprise Linux Redhat Directory Server and 1 more