huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ImageMagick: Information disclosure and unauthorized modification via symlink TOCTOU vulnerability
CVE: CVE-2026-28689
Component: ImageMagick
CWE: CWE-367
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-09T21:39:13.731000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A time-of-check to time-of-use (TOCTOU) vulnerability exists where authorization for a file path is checked before the file is finally opened or used. A local attacker can exploit this by performing a symlink swap between the check-time and use-time, bypassing policy-denied read/write operations. This can lead to information disclosure and unauthorized modification of files.

Statement: This MODERATE impact vulnerability in ImageMagick allows a Time-of-Check to Time-of-Use (TOCTOU) symlink race. An attacker could exploit this to bypass path policy restrictions, potentially leading to unauthorized read or write access to files. This affects Red Hat Enterprise Linux and Community Projects that include ImageMagick.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Linux kernel (dpaa2-switch): Out-of-bounds read in IRQ handler due to improper if_id validation
CVE: CVE-2026-23180
Component: kernel
CWE: CWE-1285
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: add bounds check for if_id in IRQ handler

The IRQ handler extracts if_id from the upper 16 bits of the hardware
status register and uses it to index into ethsw->ports[] without
validation. Since if_id can be any 16-bit value (0-65535) but the ports
array is only allocated with sw_attr.num_ifs elements, this can lead to
an out-of-bounds read potentially.

Add a bounds check before accessing the array, consistent with the
existing validation in dpaa2_switch_rx().


Remediation:
To mitigate this vulnerability, prevent the `dpaa2_switch` kernel module from loading. Create `/etc/modprobe.d/dpaa2_switch.conf` with the following content:
`install dpaa2_switch /bin/true`
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Disabling this module may impact network functionality if dpaa2-switch hardware is in use.
openCryptoki: Denial of Service and heap corruption via heap buffer overflow
CVE: CVE-2026-22791
Component: openCryptoki
CWE: CWE-131
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-01-13T19:06:41.052000+00:00

A flaw was found in openCryptoki, a library for cryptographic operations. A local attacker can exploit a heap buffer overflow vulnerability within the CKM_ECDH_AES_KEY_WRAP implementation. By providing a compressed Elliptic Curve (EC) public key and invoking the C_WrapKey function, the attacker can trigger out-of-bounds writes. This can lead to heap corruption and a denial-of-service (DoS) condition, making the application unavailable.

Statement: A local attacker can exploit a heap buffer overflow in openCryptoki's CKM_ECDH_AES_KEY_WRAP implementation, leading to heap corruption and denial of service. This vulnerability has been rated as Moderate by the Red Hat Product security team as, although it may lead to a out-of-bounds write, the impact is limited. When exploiting this vulnerability the attacker has little control over the memory position to be overwritten, additionally the size of the buffer being overwritten is relatively small (around 32 bytes for a P-256 public key for example) making it very difficult to inject any valid payload into memory.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
FreeRDP: Arbitrary code execution and denial of service via malicious server
CVE: CVE-2026-23883
Component: freerdp
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-19T17:15:55.735000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit a use-after-free vulnerability by enticing a client to connect to it. This can lead to a client-side crash, resulting in a Denial of Service (DoS), and potentially allow for arbitrary code execution due to heap corruption.

Statement: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.

Remediation:
Unbounded RelaxNG Include Recursion Leading to Stack Overflow
CVE: CVE-2026-0989
Component: libxml2
CWE: CWE-674
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-15T00:00:00+00:00

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

Statement: This vulnerability is rated Low for Red Hat products. The flaw in libxml2's RelaxNG include handling requires attacker-controlled schema input to trigger unbounded recursion, leading to a denial of service. Exploitation is limited to scenarios where applications process untrusted RelaxNG schema files.

Remediation:
To mitigate this issue, restrict applications using libxml2 from processing untrusted RelaxNG schema files. Implement strict input validation and sanitization for all RelaxNG schema inputs to prevent the parsing of maliciously crafted, deeply nested include directives.
CVE: CVE-2026-2408
Component: Use-after-free in Cloud Workloads
Release date: 2026-02-19T23:09:40.352000+00:00

Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Flask: Information disclosure via improper caching of session data
CVE: CVE-2026-27205
Component: flask
CWE: CWE-524
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-02-21T05:21:17.214000+00:00

A flaw was found in Flask, a Web Server Gateway Interface (WSGI) web application framework. When a Flask application accesses the session object using certain methods, it may fail to set the `Vary: Cookie` header. This oversight can cause sensitive, user-specific information to be improperly cached by a caching proxy, potentially leading to information disclosure to unauthorized parties.


Remediation:
Linux kernel: Denial of Service in mac80211 Wi-Fi due to out-of-bounds write
CVE: CVE-2026-23246
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.8/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability occurs in the ieee80211_ml_reconfiguration function when processing a Multi-Link (ML) Reconfiguration element. An attacker can provide a crafted link_id value that is not properly bounds-checked, leading to an out-of-bounds write on the stack. This can result in a denial of service (DoS), potentially making the system unavailable.

Statement: A stack out of bounds write in mac80211 can occur when parsing the ML Reconfiguration element because link_id can be 15 while link_removal_timeout only has 15 entries indexed 0 to 14. A nearby attacker can potentially trigger this by injecting crafted 80211 management frames that include ML Reconfiguration subelements with an invalid link_id. For the CVSS the PR:N is used for the upper boundary score level because the attacker does not need any privileges and only needs radio proximity to the WiFi interface that processes such frames. The issue is adjacency network reachable over the wireless medium rather than the public Internet. Impact is at least denial of service via kernel crash. For the CIA of the CVSS only considering A:H, but still considering a limited integrity impact possibility because the bug class is a stack out of bounds write and may be exploitable in some environments.

Remediation:
Buffer underflow in ssh_get_hexa() on invalid input
CVE: CVE-2026-0966
Component: libssh
CWE: CWE-124
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2026-02-10T18:47:15.531000+00:00

No description is available for this CVE.


Remediation:
To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the `LogLevel` in the `sshd_config` file to a value lower than `SSH_LOG_PACKET` (e.g., `INFO`).

To disable GSSAPI authentication, add or modify the following line in `/etc/ssh/sshd_config`:
`GSSAPIAuthentication no`

To reduce logging verbosity, add or modify the following line in `/etc/ssh/sshd_config`:
`LogLevel INFO`

After making changes to `sshd_config`, the `sshd` service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions.
CVE: CVE-2026-1224
Component: Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
Release date: 2026-01-24T01:37:37.554000+00:00

Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
CVE: CVE-2026-31806
Component: freerdp
CWE: CWE-131
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T17:40:19.920000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The `gdi_surface_bits()` function, which processes `SURFACE_BITS_COMMAND` messages, does not properly validate image dimensions (`bmp.width` and `bmp.height`) provided by a malicious RDP server. This can lead to a heap buffer overflow during bitmap decoding and memory operations. A remote attacker could exploit this to overwrite adjacent memory, potentially resulting in arbitrary code execution.

Statement: For this vulnerability to be exploited, a susceptible system must connect to a malicious server. For that reason, Red Hat recommends that you only use FreeRDP to connect to trusted servers.

Remediation:
tracing: Add recursion protection in kernel stack trace recording
CVE: CVE-2026-23138
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's tracing subsystem. When tracing RCU events with the kernel stack trace trigger enabled, an infinite recursion can occur because the stack trace recording code calls back into RCU, which then triggers another stack trace. This leads to a stack overflow and kernel crash.

Statement: Triggering this vulnerability requires the ability to configure kernel tracing with specific event triggers, which typically requires root or CAP_SYS_ADMIN privileges. The fix adds recursion protection bits to prevent re-entry into the stack trace code from the same context.

Remediation:
iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
CVE: CVE-2026-23092
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source

When simple_write_to_buffer() succeeds, it returns the number of bytes
actually copied to the buffer. The code incorrectly uses 'count'
as the index for null termination instead of the actual bytes copied.
If count exceeds the buffer size, this leads to out-of-bounds write.
Add a check for the count and use the return value as the index.

The bug was validated using a demo module that mirrors the original
code and was tested under QEMU.

Pattern of the bug:
- A fixed 64-byte stack buffer is filled using count.
- If count > 64, the code still does buf[count] = '\0', causing an
- out-of-bounds write on the stack.

Steps for reproduce:
- Opens the device node.
- Writes 128 bytes of A to it.
- This overflows the 64-byte stack buffer and KASAN reports the OOB.

Found via static analysis. This is similar to the
commit da9374819eb3 ("iio: backend: fix out-of-bound write")


Remediation:
go-tuf client DoS via malformed server response
CVE: CVE-2026-23991
Component: github.com/theupdateframework/go-tuf/v2
CWE: CWE-754
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-22T02:16:37.294000+00:00

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
CVE: CVE-2026-2776
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:12.247000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
thunderbird: Use-after-free in the DOM: Core & HTML component
CVE: CVE-2026-2799
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:28.665000+00:00

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Use after free in TextEncoding
CVE: CVE-2026-3921
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An use after free flaw was found in the TextEncoding component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=484946544

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Mitigation bypass in the Privacy: Anti-Tracking component
CVE: CVE-2026-24868
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-27T15:58:48.472000+00:00

Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability affects Firefox < 147.0.2.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
FreeRDP has a heap-use-after-free in video_timer
CVE: CVE-2026-24491
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:13:44.302000+00:00

A use after free flaw has been discovered in FreeRDP. The video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. A malicious server can trigger a client‑side heap use after free causing a crash (DoS).

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
tracker-miners: GNOME localsearch MP3 Extractor: Denial of Service and information disclosure via malformed MP3 files.
CVE: CVE-2026-1766
Component: localsearch
CWE: CWE-805
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-02-02T11:11:00+00:00

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory.

Statement: This vulnerability has MODERATE impact. A heap buffer overflow in GNOME localsearch's MP3 extractor (`tracker-extract-mp3`) can lead to a denial of service and potential information disclosure. The flaw is triggered when processing a specially crafted MP3 file containing malformed ID3v2.3 COMM tags.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
CVE: CVE-2026-26013
Component: langchain
CWE: CWE-918
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-10T21:51:07.741000+00:00

A flaw was found in LangChain. The ChatOpenAI.get_num_tokens_from_messages method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This issue allows an attacker to cause Server-Side Request Forgery (SSRF) by providing malicious image URLs in user input.

Statement: To exploit this issue, an attacker needs to be able to provide a malicious image_url to a LangChain instance. However, the server responses are not returned to the attacker (blind SSRF), increasing the complexity of exploitation. Additionally, an attacker can cause the server to fetch large files, potentially resulting in a high consumption of bandwidth or CPU, causing a limited impact to availability but not a complete denial of service. Due to these reasons, this vulnerability has been rated with a low impact.

Remediation:
To mitigate this issue, manually validate that all image_url fields use the HTTP/HTTPS protocols, point to allowed public domains and do not resolve to internal IP addresses before passing messages to ChatOpenAI or any LangChain model.
mm, swap: restore swap_space attr aviod kernel panic
CVE: CVE-2026-23211
Component: kernel
CWE: CWE-280
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T00:00:00+00:00

A flaw was found in the Linux kernel's memory management swap subsystem. A previous commit marked the swap address space as read-only, but when arch_prepare_to_swap() fails under heavy memory pressure, the kernel attempts to set a writeback error on the read-only mapping. This triggers a kernel panic during memory reclaim operations in the page fault handler path.

Statement: This issue can occur on systems under heavy memory pressure when swap operations fail and the kernel attempts to record the error. The panic occurs in the memory reclaim path, making it potentially triggerable by any workload that causes significant memory pressure. The fix restores the swap address space to read-write to allow error reporting.

Remediation:
ImageMagick: Denial of Service due to NULL pointer dereference during temporary file creation failure
CVE: CVE-2026-25795
Component: ImageMagick
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T00:54:34.640000+00:00

A flaw was found in ImageMagick, a widely used image editing and manipulation software. This vulnerability arises from a NULL pointer dereference that occurs when the software attempts to create temporary files and fails. An attacker could exploit this issue to trigger an application crash, leading to a Denial of Service (DoS).

Statement: This MODERATE impact flaw in ImageMagick can lead to a denial of service due to a NULL pointer dereference when processing a crafted SFW image file. The vulnerability occurs if temporary file creation fails during image processing. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected by this flaw.

Remediation:
To reduce the risk associated with this vulnerability, avoid processing untrusted SFW image files with ImageMagick. If ImageMagick is deployed in environments where it processes untrusted input, consider implementing sandboxing or resource limits for ImageMagick processes to contain potential crashes and limit impact.
thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
CVE: CVE-2026-2760
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:00.290000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read
CVE: CVE-2026-22695
Component: libpng
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-01-12T22:55:40.204000+00:00

A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.

Statement: This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.