CVE-2026-4111

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Cert Manager Discovery and 10 more

CVE-2026-52722

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer Project Redhat

Products

Gstreamer Plugin Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-52720

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer Project Redhat

Products

Gstreamer Plugin Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-52719

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer Project Redhat

Products

Gstreamer Plugin Enterprise Linux Enterprise Linux Eus and 3 more

CVE-2026-50264

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-50261

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-50260

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-50258

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 7 more

CVE-2026-50259

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org Xorg

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 9 more

CVE-2026-50257

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-50256

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 8 more

CVE-2026-48863

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Libsolv Redhat

Products

Libsolv Enterprise Linux Hummingbird and 4 more

CVE-2026-5201

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gdk-pixbuf Ai Inference Server Enterprise Linux and 21 more

CVE-2026-4878

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Libcap Project Redhat

Products

Libcap Ai Inference Server Cert Manager and 18 more

CVE-2026-4802

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

CVSS 3.1 · 8 High EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel Aus and 4 more

CVE-2026-4775

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Libtiff Redhat

Products

Debian Linux Libtiff Ai Inference Server and 17 more

CVE-2026-4631

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 15.5% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Rhel Els and 1 more

CVE-2026-117926

Incorrect boundary conditions in the SVG component

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-42170

Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Els

CVE-2026-4480

Samba: samba: remote code execution in printing subsystem via unescaped job description

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

CVSS 3.1 · 9 Critical EPSS 28.7% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Enterprise Linux Eus Openshift and 8 more