Red Hat Enterprise Linux 6.

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: stack buffer overflow in psd image resource header loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: out-of-bounds read in std::from_chars

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: stack overflow in std::bitset on libstdc++

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gcc: integer wrap in `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-667

Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Broken access control

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-672

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Denial of service

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

• Samba
• Red Hat Enterprise Linux 10
• CWE-178

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 10
• CWE-648

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Parted: parted: denial of service via heap buffer overflow during fat16 resize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Nautilus: nautilus: arbitrary file deletion via trash symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Libarchive: libarchive: use-after-free via aliased mac metadata copy

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: paa integer overflow out-of-bounds read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-1050

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Spice-server: spice: heap oob read/write via unchecked migration data offsets

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Evolution-data-server: local file disclosure via attach file:// uris

• GNOME evolution-data-server
• Red Hat Enterprise Linux 10
• Information disclosure

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

• Red Hat Hardened Images
• Red Hat Enterprise Linux 6
• Path traversal