huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
FreeRDP heap-buffer-overflow
CVE: CVE-2026-22852
Component: freerdp
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-01-14T17:45:22.253000+00:00

A heap based buffer overflow has been discovered in FreeRDP. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and writes past the newly allocated formats array, causing memory corruption and a crash.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Asterisk: Arbitrary code execution and file overwrite as root via insecure ast_coredumper file handling
CVE: CVE-2026-23740
Component: Asterisk
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-06T16:43:41.330000+00:00

A flaw was found in Asterisk. When the ast_coredumper writes its gdb init and output files to a world-writable directory, a local attacker with write permissions to that directory can exploit this vulnerability. By manipulating the gdb init file and output paths, the attacker can cause the system to execute arbitrary commands as root or overwrite arbitrary files, leading to privilege escalation and potential system compromise.

Statement: This IMPORTANT vulnerability in Asterisk allows a local attacker to achieve privilege escalation. When the `ast_coredumper` writes to a world-writable directory, such as `/tmp`, a local user can manipulate the GDB init and output files. This manipulation can lead to the execution of arbitrary commands as root or the overwriting of arbitrary files. This affects Asterisk packages in Red Hat Community Projects, including EPEL 8, EPEL 9, Fedora 42, and Fedora 43.

Remediation:
Linux kernel (arm64): Denial of Service via NULL pointer dereference in ZA signal context restoration
CVE: CVE-2026-23107
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel on arm64 architectures. When restoring a ZA signal context, the kernel may fail to allocate the necessary memory (`sve_state`), leading to a NULL pointer dereference. A local, unprivileged user can exploit this vulnerability, potentially causing the kernel to crash and resulting in a Denial of Service (DoS).

Statement: A local NULL pointer dereference can occur on arm64 when restoring a ZA signal context because restore_za_context can set TIF_SME without ensuring current thread sve_state is allocated. In uncommon but legitimate scenarios such as process save and restore workflows using CRIU the signal context may not have been created by the same kernel task and there is no guarantee that sve_state exists. In that state userspace can enter streaming mode while sve_state is NULL and a later kernel attempt to save register state can dereference NULL in sve_save_state and crash the kernel. For the CVSS the PR is N because an unprivileged local process can reach signal return paths without special rights. The issue is not network reachable. Impact is denial of service via kernel crash.

Remediation:
Race in DevTools
CVE: CVE-2026-2319
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-10T00:00:00+00:00

Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
CVE: CVE-2026-0774
Component: WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:48:02.551000+00:00

WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WatchYourLAN. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the arpstrs parameter. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26708.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
idpf: fix aux device unplugging when rdma is not supported by vport
CVE: CVE-2026-23042
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix aux device unplugging when rdma is not supported by vport

If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not
allocate vdev_info for this vport. This leads to kernel NULL pointer
dereference in idpf_idc_vport_dev_down(), which references vdev_info for
every vport regardless.

Check, if vdev_info was ever allocated before unplugging aux device.

Statement: The idpf driver can hit a NULL pointer dereference when unplugging the RDMA auxiliary device for a vport that does not support RDMA. If the vport flags do not include VIRTCHNL2_VPORT_ENABLE_RDMA then vdev_info is never allocated. The teardown path idpf_idc_vport_dev_down still assumes vdev_info exists and dereferences it which can crash the kernel. For the CVSS the PR is L in the paranoid score because some deployments delegate network administration to containers or services that can trigger device reset or teardown paths. In typical systems PR is H because driver unload and device management are administrator operations. The issue is not network reachable. Impact is denial of service via kernel crash.

Remediation:
Svelte: Cross-Site Scripting via unsanitized error output
CVE: CVE-2026-27902
Component: svelte
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-02-26T00:58:54.604000+00:00

A cross-site scripting (XSS) vulnerability was found in Svelte’s server-side rendering (SSR) error handling. Error messages returned from the transformError function were not properly escaped before being embedded into HTML output within hydration markers. If an application returns attacker-controlled content through transformError, the content may be interpreted as HTML in the rendered page, resulting in HTML injection and potential execution of arbitrary JavaScript in a victim’s browser. Successful exploitation could allow an attacker to access sensitive information or perform actions in the context of the affected user.

Statement: This MODERATE severity cross-site scripting (XSS) flaw in Svelte's server-side rendering (SSR) error handling allows for HTML injection. If an application utilizing Svelte's SSR returns attacker-controlled content through the `transformError` function, it could lead to the execution of arbitrary JavaScript in a victim's browser. This only affects applications or packages that embed or utilize Svelte in a server-side rendering context.

Remediation:
lz4_flex's decompression can leak information from uninitialized memory or reused output buffer
CVE: CVE-2026-32829
Component: lz4_flex
CWE: CWE-823
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-16T20:48:08+00:00

No description is available for this CVE.


Remediation:
net: do not write to msg_get_inq in callee
CVE: CVE-2026-22983
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's AF_UNIX socket implementation. In unix_stream_read_generic(), when splicing is used (state->msg is NULL), the code attempts to write to msg->msg_get_inq which dereferences the NULL pointer. This occurs because the callee incorrectly writes to msg_get_inq which is supposed to be an input-only field from caller to callee.

Statement: This vulnerability affects systems using AF_UNIX stream socket splicing functionality. The NULL dereference occurs during splice operations on Unix domain sockets when the msg structure is not provided. The issue was introduced when splice support was added for stream AF_UNIX sockets. Triggering requires local access to create and splice Unix sockets.

Remediation:
Sequelize: Data exfiltration via SQL injection in JSON/JSONB where clause processing
CVE: CVE-2026-30951
Component: sequelize
CWE: CWE-89
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-10T20:22:46.150000+00:00

A flaw was found in Sequelize, a Node.js Object-Relational Mapper (ORM) tool. A remote attacker can exploit a SQL injection vulnerability by manipulating JSON object keys during JSON/JSONB where clause processing. This allows for the injection of arbitrary SQL commands due to the improper handling of cast types. The primary consequence is the potential for unauthorized data exfiltration from any database table.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Calibre: HTTP Response Header Injection via unsanitized query parameter
CVE: CVE-2026-27810
Component: calibre
CVSS v3: 6.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-02-27T19:44:39.106000+00:00

A flaw was found in calibre, an e-book manager. An authenticated user can exploit an HTTP Response Header Injection vulnerability in the calibre Content Server. This is due to an unsanitized `content_disposition` query parameter in specific endpoints, allowing the injection of arbitrary HTTP headers into server responses. This could lead to information disclosure or other impacts by manipulating server behavior.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick: Memory disclosure and denial of service via crafted MAP files
CVE: CVE-2026-25987
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-24T01:46:24.519000+00:00

A flaw was found in ImageMagick. A remote attacker could exploit a heap buffer over-read vulnerability in the MAP image decoder by providing a specially crafted MAP file. This could lead to the application crashing, resulting in a denial of service, or unintended memory disclosure during image decoding.

Statement: This MODERATE impact vulnerability in ImageMagick's MAP image decoder can lead to crashes or unintended memory disclosure when processing specially crafted MAP files. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected by this flaw.

Remediation:
To mitigate this issue, avoid processing untrusted MAP image files with ImageMagick. Restrict the sources of MAP files to only trusted origins to prevent potential exploitation.
ImageMagick: Memory corruption via stack buffer overflow when processing an attribute
CVE: CVE-2026-25968
Component: ImageMagick
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-02-24T01:30:58.881000+00:00

A flaw was found in ImageMagick. A remote attacker could exploit a stack buffer overflow vulnerability by providing a specially crafted image file with a long attribute value. This flaw occurs when processing an attribute in msl.c, leading to memory corruption. This can result in unpredictable behavior or a denial of service.

Statement: A MODERATE impact stack buffer overflow flaw exists in ImageMagick. This vulnerability occurs when processing a specially crafted image file containing a long attribute value, leading to memory corruption, unpredictable behavior, or a denial of service. This affects ImageMagick as shipped in Red Hat Enterprise Linux, Fedora, and Community Projects, requiring the processing of a malicious image file for exploitation.

Remediation:
To reduce the risk associated with this vulnerability, avoid processing untrusted or maliciously crafted image files with ImageMagick. If ImageMagick is not required for system operations, consider removing packages that depend on it. Removing ImageMagick or its dependent packages may affect applications that rely on its image processing capabilities.
gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths
CVE: CVE-2026-23015
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths

The reference obtained by calling usb_get_dev() is not released in the
gpio_mpsse_probe() error paths. Fix that by using device managed helper
functions. Also remove the usb_put_dev() call in the disconnect function
since now it will be released automatically.


Remediation:
libheif: Out-of-bounds read via local argument manipulation
CVE: CVE-2026-3949
Component: libheif
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-11T18:32:09.358000+00:00

A flaw was found in libheif. This vulnerability allows a local attacker to trigger an out-of-bounds read by manipulating the size argument in the `vvdec_push_data2` function. This could lead to a denial of service (DoS).

Statement: This is a LOW impact vulnerability in libheif affecting Red Hat Community Projects. A local attacker can trigger an out-of-bounds read by manipulating arguments to the `vvdec_push_data2` function, potentially leading to a denial of service. Exploitation requires local access to the system.

Remediation:
furnace: A heap-based buffer over-read or buffer overflow in tildearrow/furnace
CVE: CVE-2026-24800
Component: tildearrow
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-27T08:33:16.882000+00:00

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies
CVE: CVE-2026-28435
Component: cpp-httplib
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-04T19:36:33.418000+00:00

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in Blink
CVE: CVE-2026-4449
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An use after free flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=487117772

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
backstage/plugin-scaffolder-backend: backstage/plugin-scaffolder-node: possible symlink path traversal in scaffolder actions
CVE: CVE-2026-24046
Component: backstage/backend-defaults
CWE: CWE-59
Severity: Important
CVSS v3: 8.8/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Release date: 2026-01-21T22:36:30.794000+00:00

A flaw was found in Backstage. A symlink-based path traversal issue can be exploited in multiple Scaffolder actions and archive extraction utilities during template execution via malicious symlinks. An attacker with access to create and execute Scaffolder templates can read sensitive files, delete arbitrary files or write files outside the intended workspace, resulting in unauthorized information disclosure or system compromise.

Statement: To exploit this issue, an attacker needs to have access to create and execute Scaffolder actions, specifically the debug:log, fs:delete actions and archive extractions, limiting the exposure of this flaw. Additionally, file systems operations are constrained by the permissions of the process, limiting the impact to files that can be accessed by Backstage. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
To mitigate this issue, consider implementing strict access controls for Backstage Scaffolder templates. Restrict the ability to create and execute Scaffolder templates to trusted users only, utilizing the Backstage permissions framework. Additionally, audit existing templates for any symlink usage and consider running Backstage within a containerized environment with a highly restricted filesystem to limit potential impact.
Wireshark: Denial of service via IEEE 802.11 protocol dissector crash
CVE: CVE-2026-0959
Component: Wireshark
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-14T20:23:28.986000+00:00

A flaw was found in Wireshark. A remote attacker could exploit a crash in the IEEE 802.11 protocol dissector by crafting a malicious network packet. This vulnerability leads to a denial of service, making the Wireshark application unavailable.

Statement: This vulnerability is rated Moderate for Red Hat. An out-of-bounds write flaw in the IEEE 802.11 protocol dissector of Wireshark can lead to a denial of service. Exploitation requires user interaction, as a malicious packet capture file must be opened, and has high attack complexity, limiting the overall impact.

Remediation:
To mitigate this issue, users should avoid opening untrusted or suspicious packet capture files with Wireshark. Limiting the use of Wireshark to trusted environments and only processing network traffic from known sources can reduce the risk of exploitation.
Linux kernel: Denial of Service in Bluetooth HCI UART driver via null pointer dereference
CVE: CVE-2026-23146
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth HCI UART driver. A race condition exists where the `hci_uart_write_work()` function may attempt to access uninitialized private data if a TTY write wakeup occurs during the protocol initialization phase. This can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the `hci_uart` kernel module from loading. This can be achieved by creating a blacklist file for the module.

Create a file named `/etc/modprobe.d/blacklist-hci_uart.conf` with the following content:

```
blacklist hci_uart
install hci_uart /bin/true
```

After creating the file, regenerate the initramfs to ensure the blacklist is applied during boot:

For RHEL 9 and 10:
`sudo dracut -f -v`

For RHEL 6 ELS:
`sudo dracut -f`

A reboot is required for the changes to take effect. This mitigation will disable Bluetooth HCI UART functionality, which may impact systems relying on this driver for Bluetooth communication.
FreeRDP has a heap-use-after-free in ainput_send_input_event
CVE: CVE-2026-24683
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:22:17.636000+00:00

A heap buffer use after free has been discovered in FreeRDP. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libsoup: HTTP Request Smuggling via Duplicate Content-Length Headers
CVE: CVE-2026-2708
Component: libsoup
CWE: CWE-444
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-02-18T20:13:57.701000+00:00

No description is available for this CVE.

Statement: The practical impact is limited because SoupServer is a testing and development utility, not designed for production internet infrastructure. Exploitation requires a deployment topology where SoupServer is serving real traffic behind (or in front of) another HTTP server acting as a proxy — a scenario that contradicts its intended use.

Remediation:
FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`
CVE: CVE-2026-31897
Component: freerdp
CWE: CWE-125
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-13T17:42:11.932000+00:00

An out of bounds read flaw has been discovered in FreeRDP. This Out-of-bounds read exists in the `freerdp_bitmap_decompress_planar` function when SrcSize is 0. This flaw may allow an attcker to read of 1 byte from heap memory in some situation. The more common and expected impact is a crash when the read hits an unmapped page.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.