Vulnerabilities

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

CVE-2026-13097 is a privilege escalation in FreeIPA caused by the uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server failing to treat equivalent representations of the same principal name as duplicates (CWE-706, incorrectly-resolved name/reference). A user with sufficient LDAP write privileges can exploit this by creating a service principal whose name is an alternate but equivalent form of an existing privileged principal, bypassing the uniqueness check. The attacker can then acquire Kerberos service tickets for sensitive services as the impersonated principal, potentially achieving full domain compromise; the flaw scores 8.7 (high) on CVSS 3.1 with a scope change from the directory server to the Kerberos realm. Affected organizations are those running FreeIPA (Red Hat Enterprise Linux IdM) with 389-ds directory services. No exploitation is known at this time, no public proof-of-concept exists, and the flaw is not in CISA KEV; EPSS puts 30-day exploitation probability at 0.3% (19th percentile), though related FreeIPA flaw-chain research (anonymous clients creating reusable administrator credentials) has drawn attention to the product.

Do: Monitor Red Hat advisories and upgrade 389-ds-base and freeipa/IdM packages to the fixed releases for your RHEL version as soon as they are published, since no fixed version numbers are listed in the current data. Until patched, restrict LDAP write privileges on Kerberos principal name attributes to the minimum set of roles, and audit the directory for existing principals whose names are case- or format-equivalent variants of privileged principals (e.g., admin, kadmin, host and service principals). Given the related FreeIPA flaw-chain research on anonymous clients obtaining reusable administrator credentials, also review anonymous/simple-bind directory access and apply any companion FreeIPA fixes.

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.

A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure.

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.

CVE-2026-59090 is an unsigned integer underflow (CWE-191) in the block_rem variable of GIMP's PSD file-format plugin. It is triggered when a user opens a specially crafted .psd image file, causing the parser to lose track of block boundaries and allowing an attacker to inject arbitrary data as layer resource blocks. Successful exploitation can ultimately result in arbitrary code execution on the victim's system. Any system running a vulnerable GIMP build, including the GIMP package shipped with Red Hat Enterprise Linux, is affected if it is used to open untrusted PSD files; the source data does not specify affected or fixed version ranges. No in-the-wild exploitation is reported (not in CISA KEV, EPSS ~0.6%), but a public proof-of-concept reference exists via the GNOME GitLab issue tracker (issue #16509).

Do: Inventory endpoints for GIMP installations, prioritizing users who receive third-party PSD files, and upgrade to a patched GIMP build once Red Hat or GNOME publish fixed versions (no fixed version is given in this data; track GNOME GitLab issue #16509 and Red Hat security advisories). Until patched, treat unsolicited or untrusted .psd files as untrusted input and open them only in a sandboxed environment or with an alternative viewer. Note the reported EPSS probability (0.6%) is low and there is no KEV listing, so this is a hardening priority rather than an active-incident response.

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

A flaw in libkcapi, the user-space library for the Linux kernel crypto API, lets a local attacker hang an application that uses its Asynchronous Input/Output (AIO) interface. When an AIO-enabled handle is reused after a prior completion error, the internal _kcapi_aio_read_all() routine enters a non-terminating wait loop, leaving the calling application or thread permanently unresponsive. The attacker gains a persistent denial of service only - no code execution or data exposure - consistent with the CVSS 5.1 score (local vector, high attack complexity, availability-only impact, CWE-835). Exposure includes the library as shipped in Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, and Red Hat hardened images, plus upstream libkcapi builds, though in practice only applications that actually use libkcapi's AIO APIs are reachable. There is no evidence of in-the-wild exploitation (not in CISA KEV; EPSS ~0.2%), but a public proof-of-concept is referenced in Red Hat Bugzilla #2462867.

Do: Track Red Hat security errata for CVE-2026-71227 and update the libkcapi package (and dependent base images, including OpenShift node images) when a fixed version is published. In the interim, audit whether any local applications on your hosts call libkcapi's AIO APIs (kcapi_aio_*), and if so, avoid reusing AIO-enabled handles after a completion error and be prepared to restart hung processes. Because the flaw requires local access and high attack complexity, prioritize patching multi-tenant systems where untrusted local users exist.