Red Hat Enterprise Linux 9.

Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Denial of service

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gimp: stack vla size underflow denial of service in seattle

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Bluez: stack overflow in name2utf8 causes dos and potential code execution

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Emacs: emacs: command injection via crafted filenames in tramp

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Code injection

Webkitgtk: use-after-free of jscvalue function parameters

• WebKit
• WebKitGTK
• Memory corruption

Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

• Red Hat Certificate System 10
• Red Hat Certificate System 11
• Weak cryptography or TLS

Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Privilege escalation

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-706

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-197

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

• vim
• Red Hat Hardened Images
• Code injection

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Denial of service

Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• CWE-681

Samba: ctdb fails to do integrity checking of received packets

• Red Hat Ceph Storage 9.2
• Red Hat Enterprise Linux 10
• CWE-353

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Denial of service

Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-377

Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-377

Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

• GStreamer gst-plugins-good
• Red Hat Enterprise Linux 10
• Memory corruption

Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

• GStreamer gst-plugins-good
• Red Hat Enterprise Linux 10
• Memory corruption

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• HTTP request smuggling

Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Code injection

Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-20

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives

• Pen Drive Powered by Red Hat Lightspeed
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Information disclosure

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-681

Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Memory corruption

Libvirt: swtpm privilege escalation via symlink following

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Libvirt: information disclosure via world-readable storage volume images during clone/convert

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
• Memory corruption

Gimp: gimp: denial of service via signed integer overflow in fli file processing

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Broken access control

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption