RHSA-2026:74463

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

A flaw was found in GLib.

A flaw was found in GLib.

A double free issue has been identified in libarchive's RAR5 reader.

A flaw was found in xdgmime.

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib.

A flaw was found in GLib.

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so…

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.

A flaw was found in GLib.

A flaw was found in GLib.

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying…

urllib3 is an HTTP client library for Python.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with…

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

A flaw was found in GLib.

Vim is an open source, command line text editor.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

urllib3 is an HTTP client library for Python.

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API.

A flaw was found in libsolv.

A flaw was found in GLib.

Vim is an open source, command line text editor.

A flaw was found in libtiff.

Vim is an open source, command line text editor.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacke…

Tesseract is an open source OCR engine.

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data.

Vim is an open source, command line text editor.

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.