A stack-based buffer overflow exists in the gnutls_pkcs11_token_init() function of the GnuTLS library in Red Hat Enterprise Linux 10. When a PKCS#11 token label exceeding expected length is processed, the function writes beyond the allocated stack buffer, causing memory corruption. This flaw can cause the application using GnuTLS to crash or, under certain conditions, be exploited for local code execution or privilege escalation. The vulnerability has been assigned CVE-2025-9820 with a CVSS v3.1 base score of 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Red Hat has issued security advisories RHSA-2026:3477 and RHSA-2026:13812 providing updated GnuTLS packages and container images that include patches for this issue. The updates cover multiple architectures and related Red Hat products including OpenShift Container Platform. No known exploits in the wild have been reported.

The vulnerability can cause denial of service through application crashes and may allow local privilege escalation or code execution under specific conditions. The CVSS score of 4.0 reflects a medium severity impact with local attack vector and no confidentiality or integrity impact. Systems running vulnerable versions of GnuTLS on Red Hat Enterprise Linux 10 or affected container images are at risk until patched. There are no reports of active exploitation in the wild at this time.

Red Hat has released official patches for GnuTLS in Red Hat Enterprise Linux 10 and updated RHEL-8 based Middleware Containers images that address CVE-2025-9820. Users should apply the updated packages (gnutls-3.8.10-3.el10_1 or later) available from Red Hat repositories and rebuild any dependent container images using the updated base images from the Red Hat Container Registry. Detailed update instructions are provided in Red Hat advisories RHSA-2026:3477 and RHSA-2026:13812. Applying these updates fully mitigates the vulnerability. No additional action is required beyond applying the vendor-provided patches.