Red Hat Enterprise Linux 9.

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: gimp: stack buffer overflow in psd image resource header loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: out-of-bounds read in std::from_chars

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: stack overflow in std::bitset on libstdc++

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gcc: integer wrap in `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-667

Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Undertow: undertow: chunkreader message length permits chunk-size overflow

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 8
• HTTP request smuggling

Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Broken access control

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-672

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Denial of service

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

• Samba
• Red Hat Enterprise Linux 10
• CWE-178

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Information disclosure

Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Goose: goose: shell history and environment leak via terminal integration

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Information disclosure

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Weak cryptography or TLS

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 8
• Path traversal

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

• Red Hat Confidential Compute Attestation
• Red Hat DPU kit for NVIDIA
• Denial of service

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-409

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-214

Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-214

Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 10
• CWE-648

Gimp: gimp: use-after-free in xcf loader via prop_selected_path

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption