Ubuntu patches nine advisories across Perl, FFmpeg, .NET, Netty, glibc, PHP, Python, Beets and Apache, then refreshes 24.04.5 LTS install media

KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

The strfmon() and strfmon_l() functions in the GNU C Library (glibc) versions 2.38 through 2.44 can write past the end of a caller-supplied buffer when a monetary conversion uses right-justified width padding. The overflow occurs when the destination buffer is large enough for the padding itself but too small for an internal memmove operation, with the field width or format string potentially attacker-influenced or a fixed susceptible pattern in the calling code. Successful exploitation yields out-of-bounds memory writes in the context of the calling application, plausibly causing crashes (denial of service) or, depending on heap layout, code execution. Any Linux application linked against glibc 2.38–2.44 that calls strfmon/strfmon_l with such patterns is affected, though no network-facing application impact was known at publication. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

Do: Apply your distribution's patched glibc packages (e.g., Ubuntu USN-8737-1 / USN-8737-2) or upgrade to a glibc release newer than 2.44, then restart long-running services so they relink against the fixed library. Audit internally developed software for calls to strfmon/strfmon_l with right-justified width padding, especially where monetary format strings or field widths derive from user input, and sanitize or cap those inputs in the interim. Since no network-facing impact is known, prioritize this as routine patching rather than emergency response, but track vendor advisories for newly identified vulnerable applications.

A stack-based buffer overflow (CWE-121) exists in the tdelete function of the GNU C Library versions 2.1 through 2.44, where two rebalancing branches push an entry onto an internal parent-node stack without checking capacity, writing one pointer past the end of an alloca-allocated array. Triggering it requires deleting a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree of at least a million nodes, meaning an attacker would need to drive a very large number of insertions and deletions through an application that uses tsearch/tdelete. The written value is a pointer into a tree node and is not directly attacker controlled, so the most likely outcome is an application crash (low confidentiality/integrity/availability impact per the CVSS 5.6 rating). No affected application in common Linux distributions has been identified, significantly limiting real-world attack surface. No public proof of concept exists and the flaw is not in the CISA KEV catalog.

Do: Apply distribution security updates for glibc as they ship (Ubuntu has published USN-8737-1 and USN-8737-2 covering this issue) rather than waiting for a targeted exploit. Audit any in-house or third-party applications that use tsearch/tdelete on attacker-influenced data, and confirm they cannot accumulate trees of a million or more nodes. Because the written value is not attacker controlled, the primary risk is denial of service via crash, so prioritize patching on long-running services that maintain large search trees.

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.

Do: Apply Microsoft's September 2026 .NET security updates as part of this month's Patch Tuesday rollout, and check Microsoft's advisory for the exact version ranges that need upgrading. Prioritize internet-facing .NET/ASP.NET applications that perform cross-origin request handling, and review their origin-verification (CORS) configuration as an interim risk reduction. Because exploitation requires user interaction, also treat user-facing lure links as part of the realistic attack path until systems are patched.

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

CVE-2026-69806 is an information-exposure flaw in Microsoft .NET (CWE-200, with an associated code-generation issue, CWE-94) that allows an authorized actor to elevate privileges locally. To trigger it, an attacker must already hold a low-privileged foothold on the target system — such as the ability to execute code as a standard local user — and the high-complexity local attack path requires no user interaction. A successful exploit carries high-impact confidentiality, integrity, and availability consequences, effectively yielding elevation of privilege on the affected host. Any organization running the affected .NET components on Windows clients or servers is in scope, and the fix shipped in Microsoft's September 2026 Patch Tuesday (September 8, 2026), part of a record 966-flaw release. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; EPSS assigns a 1.8% probability of exploitation within 30 days (77th percentile).

Do: Apply the .NET updates released with the September 2026 Patch Tuesday set via Windows Update, WSUS, or the Microsoft Update Catalog, verifying both .NET Framework and modern .NET runtimes against Microsoft's advisory for exact affected version ranges. Prioritize multi-user systems where standard users can already run code — RDS/terminal hosts, build and CI servers, and shared workstations — since the attack requires local access. No workaround is described in the available data, so patching is the primary mitigation.