Red Hat Enterprise Linux 7.

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: gimp: stack buffer overflow in psd image resource header loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: out-of-bounds read in std::from_chars

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: stack overflow in std::bitset on libstdc++

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gcc: integer wrap in `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-667

Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Broken access control

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-672

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Denial of service

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

• Samba
• Red Hat Enterprise Linux 10
• CWE-178

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 10
• CWE-648

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Parted: parted: denial of service via heap buffer overflow during fat16 resize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Nautilus: nautilus: arbitrary file deletion via trash symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Libarchive: libarchive: use-after-free via aliased mac metadata copy

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: paa integer overflow out-of-bounds read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-1050

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Command injection