RHSA-2026:74674

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one by…

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

A flaw was found in GLib.

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated si…

A flaw was found in GLib.

jq is a command-line JSON processor.

A double free issue has been identified in libarchive's RAR5 reader.

A flaw was found in gnutls.

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7.

jq is a command-line JSON processor.

A flaw was found in xdgmime.

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib.

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read.

A flaw was found in GLib.

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

A flaw was found in gnutls.

A flaw was found in GLib (Gnome Lib).

A flaw was found in libgnutls.

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.

A flaw was found in GLib.

A flaw was found in GLib.

A flaw was found in gnutls.

A flaw was found in gnutls.

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declar…

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS.

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.

urllib3 is an HTTP client library for Python.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with…

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (pres…

Vim is an open source, command line text editor.

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

A flaw was found in GLib.

Vim is an open source, command line text editor.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

A flaw was found in the libtiff library.

urllib3 is an HTTP client library for Python.

A flaw was found in Poppler's Splash backend.

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API.

A flaw was found in libsolv.

A flaw was found in gnutls.

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

A flaw was found in GLib.

Vim is an open source, command line text editor.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.

A flaw was found in libtiff.

Vim is an open source, command line text editor.

Mitgation of CVE-2026-4519 was incomplete.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

A flaw was found in libcap.

A flaw was found in gnutls.

A flaw was found in gnutls.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacke…

Vim is an open source, command line text editor.

A flaw was found in glib.

Tesseract is an open source OCR engine.

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

A flaw was found in GnuTLS.

OpenSSH before 10.3 can use unintended ECDSA algorithms.

Vim is an open source, command line text editor.

Vim is an open source, command line text editor.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data.

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

Vim is an open source, command line text editor.

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…

A flaw was found in gnutls.

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.