Merged summary · grok-4.7-build · rewritten as coverage arrives
From 12–15 October 2026, Ubuntu issued five notices fixing code-execution, denial-of-service, CSRF, and XSS flaws; none report exploitation.
Between 12 and 15 October 2026, Ubuntu published five security notices for unrelated packages, and none report active exploitation. USN-8912-1 fixes Perl DBI issues found by Harsh Raj Singhania: CVE-2026-78030 may allow arbitrary code execution through insufficient attribute validation, and CVE-2026-88816 may cause denial of service through incorrect string handling. USN-8913-1 addresses libX11 flaws that require a user to connect to a malicious X server: CVE-2026-88806 mishandles XKB keyboard map replies and may crash libX11 or possibly allow code execution, while CVE-2026-94283 and CVE-2026-94284 can crash libX11 via crafted X Input Method messages. USN-8915-1 covers FFmpeg, including Momoko Shiraishi's CVE-2026-30754 memory-handling flaw that could allow code execution on Ubuntu 16.04 LTS through 24.04 LTS, plus denial-of-service issues CVE-2026-38344, CVE-2026-38346, CVE-2026-38348, and CVE-2026-38349. USN-8930-1 fixes U-Boot NFS buffer overflows CVE-2026-74220 and CVE-2026-74221, which may cause denial of service or code execution, and lwIP use-after-free CVE-2026-74222, a denial of service limited to Ubuntu 24.04 LTS and 26.04 LTS. USN-8933-1 covers RabbitMQ CSRF via CORS wildcard handling (CVE-2026-66070) and management-UI XSS via TLS peer-certificate distinguished names (CVE-2026-66077); the notice also describes an AMQP 1.0 parsing denial of service whose CVE identifier is omitted from the provided text, which is a gap in that notice rather than a conflict among sources.
USN-8912-1 (12 Oct 2026) patches Perl DBI: CVE-2026-78030 (weak attribute checks, possible arbitrary code execution) and CVE-2026-88816 (incorrect string handling, denial of service), disclosed by Harsh Raj Singhania.
USN-8913-1 covers libX11: CVE-2026-88806 mishandles XKB keyboard map replies and may crash clients or possibly allow code execution; CVE-2026-94283 and CVE-2026-94284 can crash libX11 via crafted X Input Method messages. All require a…
USN-8915-1 fixes FFmpeg: Momoko Shiraishi's CVE-2026-30754 (incorrect memory handling, possible code execution) affects Ubuntu 16.04 LTS through 24.04 LTS; CVE-2026-38344, CVE-2026-38346, CVE-2026-38348, and CVE-2026-38349 can cause denial…
USN-8930-1 (14 Oct 2026) covers U-Boot flaws found by Shahriyar Jalayeri and Mehrun P. Hunter: CVE-2026-74220 and CVE-2026-74221 are NFS READ/READLINK buffer overflows that may cause denial of service or code execution; CVE-2026-74222 is…
USN-8933-1 (15 Oct 2026) fixes RabbitMQ Server: CVE-2026-66070 (CORS wildcard handling, possible CSRF) and CVE-2026-66077 (XSS via TLS peer-certificate distinguished names in the management UI). A separate AMQP 1.0 zero-width…
Out-of-bounds write in FFmpeg RTP H.264/HEVC encoder (negative-size memcpy)
CVE-2026-30754 is an out-of-bounds write (CWE-787) in the nal_send function of FFmpeg's RTP encoder for H.264/HEVC (libavformat/rtpenc_h264_hevc.c), where a negative size parameter (size=-3) is passed to memcpy. It is triggered when FFmpeg before 8.1 processes a crafted H.264 or HEVC input file and transmits it over RTP, corrupting memory during packetization; the flaw was found via AddressSanitizer rather than through observed attacks. An attacker who gets a malicious file processed by an FFmpeg-based streaming pipeline can corrupt memory, potentially crashing the process or, given the high confidentiality, integrity and availability ratings in the CVSS score, gaining code execution in the context of the FFmpeg process. Any FFmpeg build prior to 8.1 that invokes the RTP encoder for H.264/HEVC is affected, which in practice means media servers, relays and streaming tools that output RTP/RTSP, while deployments that only transcode or play files locally are unlikely to hit the vulnerable path. No public proof-of-concept, KEV listing, or known exploitation exists, and the 0.2% EPSS score indicates low near-term exploitation risk.
Do: Upgrade FFmpeg to 8.1 or later, which resolves the flaw in libavformat/rtpenc_h264_hevc.c. Where upgrading is not immediately possible, avoid streaming untrusted or user-supplied H.264/HEVC input through FFmpeg's RTP output (e.g., -f rtp) or restrict such jobs to trusted files. Operators should inventory FFmpeg-based streaming pipelines (media servers, relays, transcoding workers with RTP output) to confirm whether the vulnerable code path is actually used.
8.8
<1%
PoC
FFmpeg Project FFmpeg (libavformat RTP encoder for H.264/HEVC, libavformat/rtpenc_h264_hevc.c) all versions before 8.1
large≈10k–100k streaming deployments plausibly use the affected RTP path (vulnerable FFmpeg builds present in millions of installations)
NULL pointer dereference in FFmpeg libswscale allows DoS via crafted video files
FFmpeg build N-122528-gdd2976b9e1 contains a NULL pointer dereference (CWE-476) in the get_min_buffer_size function in libswscale/slice.c. An attacker triggers it by supplying a crafted video file that an FFmpeg-based application processes through the swscale slice-based scaling path, causing the process to crash. The impact is denial of service only (CVSS 3.1: 7.5, C:N/I:N/A:H), with no code execution or data exposure. Anyone running that FFmpeg build, or applications and services bundling its libswscale/FFmpeg libraries, is potentially affected; the available data does not specify which stable release versions carry the flaw. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts 30-day exploitation probability at only 0.3%.
Do: Organizations that process untrusted video with FFmpeg (transcoding services, streaming/media servers, media pipelines) should check their bundled FFmpeg build (e.g., via 'ffmpeg -version') and update to a patched FFmpeg build once the upstream fix and affected release range are published in the FFmpeg advisory for CVE-2026-38344. As interim mitigation, restrict ingestion of video files from untrusted sources and configure processing workers to restart automatically on crash, since the impact is limited to a crash/denial of service. With no known PoC or in-the-wild exploitation and low EPSS, urgency is low, but monitor the upstream advisory for the fixed versions.
CORS credential reflection in RabbitMQ management plugin enables admin session hijacking
RabbitMQ's management plugin CORS handler (rabbit_mgmt_cors.erl, match_origin/1) reflects any request Origin and sends Access-Control-Allow-Credentials: true even when the operator has configured the wildcard cors_allow_origins = "*". Because the Access-Control-Allow-Origin header echoes back the attacker's own origin, a malicious web page visited by an administrator can make authenticated, state-changing requests to the management API using that administrator's cached HTTP Basic-auth credentials. An attacker thereby gains the administrator's full management privileges over the broker (user, vhost, queue, and permission changes via the API) from an arbitrary website. Only deployments that explicitly set the wildcard CORS origin are exploitable, and the flaw is fixed in 3.13.17, 4.0.22, 4.1.13, and 4.2.6. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not in CISA's KEV catalog.
Do: Upgrade to 3.13.17, 4.0.22, 4.1.13, or 4.2.6 depending on your release branch. Regardless of upgrade, remove cors_allow_origins = "*" from rabbitmq.conf and replace it with an explicit list of trusted origins — this eliminates the precondition entirely. Also restrict the management plugin port (15672) to trusted networks or VPN, and instruct administrators not to leave cached HTTP Basic credentials in shared or long-lived browser sessions.
7.6
group max
—
RabbitMQ (management plugin, rabbit_mgmt_cors.erl) All versions prior to 3.13.17 (3.13.x branch)
RabbitMQ (management plugin, rabbit_mgmt_cors.erl) All versions prior to 4.0.22 (4.0.x branch)
NFS reply buffer overflow in U-Boot before 2026.10-rc5
U-Boot before 2026.10-rc5 has a buffer overflow in nfs_read_reply() in net/nfs-common.c, caused by signed-integer handling of NFS READ reply lengths (CWE-195). A malicious or compromised NFS server can send a crafted reply length that bypasses validation and writes far past the destination buffer. That corrupts memory or crashes the bootloader during network boot; published scoring rates availability impact high and integrity impact low, with no confidentiality impact. Devices that use this U-Boot NFS client path while booting are affected; systems that do not netboot via NFS are not reachable through this flaw. No public proof-of-concept is known, and the issue is not in CISA KEV.
Do: Upgrade U-Boot to 2026.10-rc5 or later on any device that netboots over NFS. Until then, boot only from trusted local media or a trusted NFS server on a segmented network, and disable the NFS client where it is not required. Confirm the bootloader version and whether NFS boot is actually enabled before treating a fleet as exposed.
8.8
—
DENX Software Engineering U-Boot all versions before 2026.10-rc5
largeHundreds of millions of devices ship U-Boot; exploitable NFS-netboot setups are likely on the order of low millions or fewer
Arbitrary module load leading to code execution in Perl DBI (DBD::DBM) before 1.653
Perl DBI versions before 1.653, which bundle the DBD::DBM driver, pass the dbm_type and dbm_mldbm connect attributes to Perl's require without validating that they name a module, enabling arbitrary module loading (CWE-470). An attacker who can influence either attribute, for example through a DSN fragment or an application parameter that selects a storage backend, can supply a path-shaped value that require treats as a literal filename (bypassing @INC), and the MLDBM::Serializer:: prefix prepended to dbm_mldbm does not stop traversal because only '::' separators are rewritten to '/'. Successful abuse runs the file-scope code of whatever file the value names, giving the attacker code execution on the host, typically by pointing the attribute at an attacker-controlled or pre-staged file. Any deployment of affected DBI versions that lets untrusted input set these attributes is at risk, with DBD::Gofer (which forwards connect attributes to the server side) and DBI::ProxyServer (which only checks that the DSN starts with a driver prefix) as notable exposure paths. No public proof-of-concept or in-the-wild exploitation is currently known.
Do: Upgrade to DBI 1.653 or later, which validates the dbm_type and dbm_mldbm attributes. Until then, never set these connect attributes from untrusted input, allowlist the permitted values server-side, and audit DBI::ProxyServer and DBD::Gofer deployments plus any code that builds a dbi:DBM DSN from user-controlled data.
9.8
—
Perl DBI project DBI (distribution includes the DBD::DBM driver) all versions before 1.653
Perl DBI project DBD::Gofer (attack surface: forwards client connect attributes to the server side) as shipped with DBI before 1.653
Perl DBI project DBI::ProxyServer (attack surface: validates only that a DSN starts with a driver prefix) as shipped with DBI before 1.653
Buffer Overflow in libX11 XkbGetMap Leading to Potential Code Execution
CVE-2026-88806 is a high-severity buffer overflow vulnerability in the libX11 library, specifically within the XkbGetMap function, which could lead to arbitrary code execution. The flaw is triggered when processing a malicious X server response that overflows the key_sym_map structure, requiring the client to connect to a compromised or attacker-controlled X server. A successful exploit would grant the attacker the same privileges as the connected user, potentially leading to complete system compromise. The vulnerability affects all versions of libX11 prior to 1.8.14. There are no known public proofs-of-concept or reports of exploitation in the wild at this time.
Do: Upgrade to libX11 version 1.8.14 or later, as this is the patched release. Check your system's package manager for the installed libX11 version and apply the vendor-provided security update. Since exploitation requires a malicious X server, ensure your X Window System environment is trusted and restrict connections to unknown or untrusted servers.
7.5
—
The X.Org Foundation libX11 before 1.8.14
masstens of millions of potential installations (core library in all X11-based Linux/Unix systems)
Perl DBI before 1.654 incorrectly treats a numeric FetchHashKeyName attribute as a string. fetchrow_hashref uses that attribute's raw string pointer as the hash key name without stringifying it first, so an integer or floating-point value leaves an invalid pointer and the process crashes with a segmentation fault. The result is denial of service for the Perl process, not described as code execution, and only when the attribute is set to a non-string rather than a normal column-name mode. The flaw is in the widely deployed DBI database interface for Perl, in every version before 1.654. No public proof of concept is known and it is not listed in CISA KEV.
Do: Upgrade Perl DBI to version 1.654 or later and restart long-running Perl processes so they load the fixed module. Until then, set FetchHashKeyName only to a string (such as NAME, NAME_lc, or NAME_uc) and never to an integer or floating-point value, especially if that value can come from outside the application.
7.5
—
The DBI Project DBI before 1.654
masson the order of millions of Perl installations (exact vulnerable count unknown)
Out-of-Bounds Read in libX11 XIM Parser Lets Malicious X Servers Crash Clients
libX11, the core client-side library for the X Window System, contains an out-of-bounds read (CWE-125) in the XIM (X Input Method) attribute parser in versions before 1.8.14. A malicious or compromised X server can send crafted XIM attribute data that the client-side parser reads past the end of a buffer, crashing any attached X client that uses input-method support. The impact is denial of service against the client application (availability only — no confidentiality or integrity impact), and exploitation requires a user to connect to the attacker-controlled X server, which most plausibly happens via X11 forwarding (e.g., ssh -X/-Y) to an untrusted or compromised remote host. Because libX11 ships by default on virtually every X11-based Linux/Unix desktop, the install base is enormous, though the attack path limits practical targets. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no indication of exploitation in the wild; fixes are shipping through distributions such as Ubuntu (USN-8913-1) and SUSE.
Do: Update libX11 to 1.8.14 or later via your distribution's packages (e.g., Ubuntu USN-8913-1, SUSE updates) and verify with 'dpkg -l libx11-6' or 'rpm -q libX11'. Restrict X11 forwarding: avoid 'ssh -X'/'ssh -Y' to untrusted hosts, keep X11Forwarding disabled where it is not needed, and prefer Wayland or native remote protocols when available. No restart-specific action beyond restarting long-running X clients after the library update is required.
6.5
group max
—
X.Org Foundation (freedesktop.org) libX11 before 1.8.14
largelikely on the order of hundreds of thousands of FFmpeg-based deployments (media servers, transcoders, and bundled libraries); exact vulnerable population…
RabbitMQ (management plugin, rabbit_mgmt_cors.erl) All versions prior to 4.1.13 (4.1.x branch)
+1 more
largeOn the order of tens of thousands of internet-exposed RabbitMQ management UIs; the truly exploitable subset running the wildcard CORS misconfiguration is…
nichehundreds to a few thousand exploitable deployments (rarely used DBD::DBM driver bundled with the ubiquitous DBI)
mass
tens to hundreds of millions of installations (libX11 is present by default on nearly all X11-based Linux/Unix desktops)
Ubuntu Security Notices· 34