huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Out of bounds read in Media
CVE: CVE-2026-3061
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-23T00:00:00+00:00

Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
rust_binder: correctly handle FDA objects of length zero
CVE: CVE-2026-23194
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: correctly handle FDA objects of length zero

Fix a bug where an empty FDA (fd array) object with 0 fds would cause an
out-of-bounds error. The previous implementation used `skip == 0` to
mean "this is a pointer fixup", but 0 is also the correct skip length
for an empty FDA. If the FDA is at the end of the buffer, then this
results in an attempt to write 8-bytes out of bounds. This is caught and
results in an EINVAL error being returned to userspace.

The pattern of using `skip == 0` as a special value originates from the
C-implementation of Binder. As part of fixing this bug, this pattern is
replaced with a Rust enum.

I considered the alternate option of not pushing a fixup when the length
is zero, but I think it's cleaner to just get rid of the zero-is-special
stuff.

The root cause of this bug was diagnosed by Gemini CLI on first try. I
used the following prompt:

> There appears to be a bug in @drivers/android/binder/thread.rs where
> the Fixups oob bug is triggered with 316 304 316 324. This implies
> that we somehow ended up with a fixup where buffer A has a pointer to
> buffer B, but the pointer is located at an index in buffer A that is
> out of bounds. Please investigate the code to find the bug. You may
> compare with @drivers/android/binder.c that implements this correctly.


Remediation:
Caddy: Access control bypass due to improper handling of percent-escape sequences in HTTP path matcher
CVE: CVE-2026-27587
Component: github.com/caddyserver/caddy/v2/modules/caddyhttp
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-24T16:26:40.222000+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Panic in name constraint checking for malformed certificates in crypto/x509
CVE: CVE-2026-27138
Component: crypto/x509
CWE: CWE-295
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-06T21:28:14+00:00

A certificate validation flaw has been discovered in the golang crypto/x509 module. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libucl: Denial of Service via embedded null byte in UCL input
CVE: CVE-2026-0708
Component: libucl
CVSS v3: 8.3/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Release date: 2026-01-01T00:00:00+00:00

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

Statement: This vulnerability is rated Important for Red Hat products. A flaw in the libucl library allows a remote attacker to trigger a Denial of Service (DoS) by providing specially crafted Universal Configuration Language (UCL) input containing an embedded null byte. This can lead to a segmentation fault when the malformed input is processed.

Remediation:
smb/client: fix memory leak in smb2_open_file()
CVE: CVE-2026-23205
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's CIFS/SMB client. In the smb2_open_file() function, request buffers are not properly freed when performing direct I/O writes to a read-only SMB share. This causes slab cache objects to remain allocated, which can prevent the cifs module from unloading cleanly and lead to gradual memory exhaustion with repeated operations.

Statement: Exploitation requires mounting an SMB share and performing specific I/O patterns (direct writes to read-only exports). The memory leak manifests primarily when unloading the cifs module, making it a reliability issue rather than a readily exploitable denial of service condition.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the cifs module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.
CVE: CVE-2026-0925
Component: Tanium addressed an improper input validation vulnerability in Discover.
Release date: 2026-01-24T01:37:51.794000+00:00

Tanium addressed an improper input validation vulnerability in Discover.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
CVE: CVE-2026-26007
Component: cryptography
CWE: CWE-354
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-10T21:42:56.471000+00:00

A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.


Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Harden-Runner: Data exfiltration via DNS over HTTPS (DoH) bypass
CVE: CVE-2026-32947
Component: harden-runner
CWE: CWE-807
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-20T04:03:03.687000+00:00

A flaw was found in Harden-Runner. A remote attacker with existing code execution within a GitHub Actions workflow could exploit a DNS over HTTPS (DoH) vulnerability to bypass network restrictions. This allows for the exfiltration of sensitive data by encoding it within DoH queries, which appear as legitimate HTTPS traffic, effectively bypassing egress policies.


Remediation:
ImageMagick: Denial of Service via malformed PCD file processing
CVE: CVE-2026-24485
Component: ImageMagick
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T00:34:04.907000+00:00

A flaw was found in ImageMagick. A remote attacker could exploit this vulnerability by providing a specially crafted PCD (Picture CD) image file that lacks a valid Sync marker. This causes the DecodeImage() function to enter an infinite loop, leading to continuous CPU resource consumption and system resource exhaustion. The primary consequence is a denial of service (DoS), rendering the program unresponsive.

Statement: This MODERATE impact denial of service flaw in ImageMagick allows a remote attacker to cause continuous CPU resource consumption and system resource exhaustion. This occurs when processing a specially crafted PCD image file that lacks a valid Sync marker. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected.

Remediation:
To mitigate this vulnerability, restrict ImageMagick's ability to process untrusted PCD files. If PCD file support is not required, consider disabling the PCD coder in ImageMagick's policy.xml configuration file. Add <policy domain="coder" rights="none" pattern="PCD" /> to /etc/ImageMagick-X/policy.xml (where X is the ImageMagick version). A service restart or application reload may be required for the changes to take effect.
Incorrect security UI in WebAppInstalls
CVE: CVE-2026-3935
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

An incorrect security ui flaw was found in the WebAppInstalls component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=479326680

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
PJSIP: Information disclosure vulnerability in SIP message processing
CVE: CVE-2026-33069
Component: PJSIP
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-20T08:21:51.442000+00:00

A flaw was found in PJSIP, a multimedia communication library. A remote attacker could exploit a vulnerability in the `pjsip_multipart_parse()` function when processing incoming Session Initiation Protocol (SIP) messages. This flaw, an out-of-bounds heap read, allows for the disclosure of a small amount of sensitive information from adjacent memory, impacting applications that handle multipart SIP bodies or Session Description Protocol (SDP) content.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
CVE: CVE-2026-23069
Component: kernel
CWE: CWE-191
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix potential underflow in virtio_transport_get_credit()

The credit calculation in virtio_transport_get_credit() uses unsigned
arithmetic:

  ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);

If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
are in flight, the subtraction can underflow and produce a large
positive value, potentially allowing more data to be queued than the
peer can handle.

Reuse virtio_transport_has_space() which already handles this case and
add a comment to make it clear why we are doing that.

[Stefano: use virtio_transport_has_space() instead of duplicating the code]
[Stefano: tweak the commit message]


Remediation:
ImageMagick: Out-of-bounds read via crafted Photo CD (PCD) files
CVE: CVE-2026-26284
Component: ImageMagick
CWE: CWE-131
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-02-24T02:00:19.417000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. When processing Huffman-coded data from Photo CD (PCD) files, the image decoder contains an incorrect initialization that could lead to an out-of-bounds read. This vulnerability could allow a remote attacker to cause information disclosure or a denial of service.

Statement: This MODERATE impact vulnerability in ImageMagick involves a heap overflow in the PCD (Photo CD) decoder, leading to an out-of-bounds read when processing Huffman-coded data. An attacker could exploit this by providing a specially crafted PCD file. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected.

Remediation:
To mitigate this issue, restrict ImageMagick's ability to process PCD (Photo CD) files by disabling the PCD coder. This can be done by adding or modifying a policy entry in the ImageMagick configuration file, typically located at `/etc/ImageMagick-X/policy.xml` (where 'X' is the ImageMagick version). Add the following line within the `<policymap>` tags:

```xml
<policy domain="coder" rights="none" pattern="PCD" />
```

Applications utilizing ImageMagick may require a restart for this change to take effect. This action will prevent ImageMagick from processing PCD files, which may affect functionality dependent on this format.
quinn-proto: Denial of Service via crafted QUIC Initial packet
CVE: CVE-2026-31812
Component: quinn-proto
CWE: CWE-248
Severity: Important
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-10T21:04:36.812000+00:00

A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.

Statement: The availability impact of this flaw is limited to specific services on Red Hat systems. Host system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Integer overflow in the JavaScript: Standard Library component
CVE: CVE-2026-2762
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:01.761000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Integer overflow in the JavaScript: Standard Library component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
@backstage/plugin-techdocs-node Path Traversal in TechDocs Local Generator
CVE: CVE-2026-25152
Component: @backstage/plugin-techdocs-node
CWE: CWE-22
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-01-30T21:51:22.277000+00:00

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. This vulnerability is fixed in` @backstage/plugin-techdocs-node` versions 1.13.11 and 1.14.1. Some workarounds are available. Switch to `runIn: docker` in `app-config.yaml` and/or restrict write access to TechDocs source repositories to trusted users only.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Arbitrary code execution via crafted PostScript files
CVE: CVE-2026-25797
Component: ImageMagick
CWE: CWE-94
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Release date: 2026-02-24T01:01:22.025000+00:00

A flaw was found in ImageMagick, a software used for editing and manipulating digital images. This vulnerability allows an attacker to inject malicious code into PostScript files due to improper input sanitization in the PostScript coders. When a specially crafted file is processed by a printer or viewer, this injected code can be executed, potentially leading to arbitrary code execution. A similar issue exists in the HTML encoder, where improper escaping of strings could allow for arbitrary HTML injection.

Statement: This vulnerability has a MODERATE impact. ImageMagick's PostScript coders, as shipped in Red Hat Enterprise Linux 6 ELS and 7 ELS, are susceptible to arbitrary code injection. Processing a specially crafted file could lead to the execution of malicious PostScript code when rendered by a printer or viewer.

Remediation:
To mitigate this vulnerability, restrict ImageMagick's ability to process untrusted input files, especially when generating PostScript output. Alternatively, disable the PostScript (PS) coder in ImageMagick's policy configuration to prevent the creation of potentially malicious PostScript files. This can be achieved by editing the ImageMagick policy file, typically located at /etc/ImageMagick-X/policy.xml (where X is the ImageMagick version), and adding or modifying a policy entry to disable the 'PS' format. For example, add <policy domain="coder" rights="none" pattern="PS" /> within the <policymap> tags. This action may impact applications that rely on ImageMagick's ability to write PostScript files. A service restart may be required for changes to take effect.
Out of bounds memory access in V8
CVE: CVE-2026-0899
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T00:00:00+00:00

Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
CVE: CVE-2026-23213
Component: kernel
Severity: None
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Disable MMIO access during SMU Mode 1 reset

During Mode 1 reset, the ASIC undergoes a reset cycle and becomes
temporarily inaccessible via PCIe. Any attempt to access MMIO registers
during this window (e.g., from interrupt handlers or other driver threads)
can result in uncompleted PCIe transactions, leading to NMI panics or
system hangs.

To prevent this, set the `no_hw_access` flag to true immediately after
triggering the reset. This signals other driver components to skip
register accesses while the device is offline.

A memory barrier `smp_mb()` is added to ensure the flag update is
globally visible to all cores before the driver enters the sleep/wait
state.

(cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4)


Remediation:
tracker-miners: GNOME localsearch MP3 Extractor: Heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files
CVE: CVE-2026-1764
Component: localsearch
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-02-02T11:11:00+00:00

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data.

Statement: This vulnerability has MODERATE impact. A heap buffer overflow in `tracker-extract-mp3` can occur when parsing specially crafted MP3 files containing ID3v2.4 tags. This flaw could lead to a denial of service or information disclosure if a user processes a malicious MP3 file within a desktop environment utilizing the `localsearch` component.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
dr_libs: Heap buffer overflow via crafted WAV files
CVE: CVE-2026-29022
Component: dr_libs
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-03-03T19:49:16.581000+00:00

A flaw was found in dr_libs. A remote attacker can exploit this heap buffer overflow vulnerability by providing a specially crafted WAV file. This occurs due to a mismatch in sampleLoopCount validation, allowing memory corruption and potentially leading to arbitrary code execution or denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Optimizer unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21941
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation: