redhat/papers vulnerabilities

Latest redhat/papers CVEs

Newest publication first

1. CVE-2026-81856 Terminal escape sequence injection in Hex via unneutralized server-supplied output

   Published 2026-10-12

   Low·CVSS 2.3 EPSS 0.43%

   Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository an...

2. CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.36%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirro...

3. CVE-2026-18090 Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

   Published 2026-09-08

   Medium·CVSS 6.1 EPSS 0.23%

   A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer'...

4. CVE-2026-64846 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

   Published 2026-08-20

   Low·CVSS 2.8 EPSS 0.11%

   Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause...

5. CVE-2026-5201 Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

   Published 2026-03-31

   High·CVSS 7.5 EPSS 1.1%

   A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user inte...

6. CVE-2026-1489 Glib: glib: memory corruption via integer overflow in unicode case conversion

   Published 2026-01-27

   Medium·CVSS 5.4 EPSS 0.37%

   A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in ou...

7. CVE-2026-1485 Glib: glib: local denial of service via buffer underflow in content type parsing

   Published 2026-01-27

   Low·CVSS 2.8 EPSS 0.16%

   A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds mem...

8. CVE-2026-1484 Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()

   Published 2026-01-27

   Medium·CVSS 4.2 EPSS 0.34%

   A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications tha...

9. CVE-2026-0988 Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()

   Published 2026-01-21

   Low·CVSS 3.7 EPSS 0.43%

   A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passe...

10. CVE-2025-14087 Glib: glib: buffer underflow in gvariant parser leads to heap corruption

    Published 2025-12-10

    Critical·CVSS 9.8 EPSS 0.89%

    A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.