Ubuntu security wave, September 9–16, 2026: fixes for FFmpeg, .NET, Netty, glibc, PHP, Python, Beets, Apache and GNU Guix, plus the 24.04.5 LTS point release

KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

The strfmon() and strfmon_l() functions in the GNU C Library (glibc) versions 2.38 through 2.44 can write past the end of a caller-supplied buffer when a monetary conversion uses right-justified width padding. The overflow occurs when the destination buffer is large enough for the padding itself but too small for an internal memmove operation, with the field width or format string potentially attacker-influenced or a fixed susceptible pattern in the calling code. Successful exploitation yields out-of-bounds memory writes in the context of the calling application, plausibly causing crashes (denial of service) or, depending on heap layout, code execution. Any Linux application linked against glibc 2.38–2.44 that calls strfmon/strfmon_l with such patterns is affected, though no network-facing application impact was known at publication. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

Do: Apply your distribution's patched glibc packages (e.g., Ubuntu USN-8737-1 / USN-8737-2) or upgrade to a glibc release newer than 2.44, then restart long-running services so they relink against the fixed library. Audit internally developed software for calls to strfmon/strfmon_l with right-justified width padding, especially where monetary format strings or field widths derive from user input, and sanitize or cap those inputs in the interim. Since no network-facing impact is known, prioritize this as routine patching rather than emergency response, but track vendor advisories for newly identified vulnerable applications.

A stack-based buffer overflow (CWE-121) exists in the tdelete function of the GNU C Library versions 2.1 through 2.44, where two rebalancing branches push an entry onto an internal parent-node stack without checking capacity, writing one pointer past the end of an alloca-allocated array. Triggering it requires deleting a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree of at least a million nodes, meaning an attacker would need to drive a very large number of insertions and deletions through an application that uses tsearch/tdelete. The written value is a pointer into a tree node and is not directly attacker controlled, so the most likely outcome is an application crash (low confidentiality/integrity/availability impact per the CVSS 5.6 rating). No affected application in common Linux distributions has been identified, significantly limiting real-world attack surface. No public proof of concept exists and the flaw is not in the CISA KEV catalog.

Do: Apply distribution security updates for glibc as they ship (Ubuntu has published USN-8737-1 and USN-8737-2 covering this issue) rather than waiting for a targeted exploit. Audit any in-house or third-party applications that use tsearch/tdelete on attacker-influenced data, and confirm they cannot accumulate trees of a million or more nodes. Because the written value is not attacker controlled, the primary risk is denial of service via crash, so prioritize patching on long-running services that maintain large search trees.

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.

Do: Apply Microsoft's September 2026 .NET security updates as part of this month's Patch Tuesday rollout, and check Microsoft's advisory for the exact version ranges that need upgrading. Prioritize internet-facing .NET/ASP.NET applications that perform cross-origin request handling, and review their origin-verification (CORS) configuration as an interim risk reduction. Because exploitation requires user interaction, also treat user-facing lure links as part of the realistic attack path until systems are patched.

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

CVE-2026-69806 is an information-exposure flaw in Microsoft .NET (CWE-200, with an associated code-generation issue, CWE-94) that allows an authorized actor to elevate privileges locally. To trigger it, an attacker must already hold a low-privileged foothold on the target system — such as the ability to execute code as a standard local user — and the high-complexity local attack path requires no user interaction. A successful exploit carries high-impact confidentiality, integrity, and availability consequences, effectively yielding elevation of privilege on the affected host. Any organization running the affected .NET components on Windows clients or servers is in scope, and the fix shipped in Microsoft's September 2026 Patch Tuesday (September 8, 2026), part of a record 966-flaw release. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; EPSS assigns a 1.8% probability of exploitation within 30 days (77th percentile).

Do: Apply the .NET updates released with the September 2026 Patch Tuesday set via Windows Update, WSUS, or the Microsoft Update Catalog, verifying both .NET Framework and modern .NET runtimes against Microsoft's advisory for exact affected version ranges. Prioritize multi-user systems where standard users can already run code — RDS/terminal hosts, build and CI servers, and shared workstations — since the attack requires local access. No workaround is described in the available data, so patching is the primary mitigation.