CVE-2026-87875VulnerabilityPublished 09/09/2026Updated 10/21/2026

CVE-2026-87875: Out-of-bounds Read in Red Hat Red Hat Hardened Images

Affects Red Hat Red Hat Hardened ImagesSource CVE Database V5

cwe-125

Not known to be exploited · CVSS 4.3 Medium : monitor for a fix to Red Hat Red Hat Hardened Images.

Data as of 10/24/2026, 18:17:32 UTC

CVSS 3.1 base score

4.3Medium

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
Red HatRed Hat Hardened Images	Affected–	Fixed in–
Red HatRed Hat Enterprise Linux 10	Affected–	Fixed in–
Red HatRed Hat Enterprise Linux 6	Affected–	Fixed in–
Red HatRed Hat Enterprise Linux 7	Affected–	Fixed in–
Red HatRed Hat Enterprise Linux 8	Affected–	Fixed in–
Red HatRed Hat Enterprise Linux 9	Affected–	Fixed in–
Red HatRed Hat OpenShift Container Platform 4	Affected–	Fixed in–

AI-suggested

Red Hat has released an official fix in the form of updated RPM packages (cups 2.4.19-4.1.hum1 and related components) for Red Hat Hardened Images. Users should apply these updates promptly to remediate the vulnerability. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-87875 for detailed update instructions.

Description

CVE-2026-87875 is a medium severity vulnerability in Red Hat Hardened Images involving an out-of-bounds read in the cupsUTF32ToUTF8() function of CUPS. The flaw arises because the function lacks a source-length bound, allowing a heap out-of-bounds read triggered via SNMP supply-description parsing with attacker-controlled input. Red Hat has released updated RPM packages including cups-2.4.19-4.1.hum1 to address this issue.

Impact

The vulnerability allows an attacker to cause a heap out-of-bounds read, which may lead to information disclosure (confidentiality impact). There is no impact on integrity or availability according to the CVSS vector. The attack vector is adjacent network (AV:A), requiring no privileges or user interaction.

Summary

The vulnerability CVE-2026-87875 exists in the cupsUTF32ToUTF8() function within CUPS's cups/transcode.c, where the absence of a source-length bound can cause a heap out-of-bounds read. This can be reached through SNMP supply-description parsing in backend/snmp-supplies.c when processing attacker-controlled content. The issue affects Red Hat Hardened Images and has been addressed by Red Hat in updated RPM packages (cups 2.4.19-4.1.hum1 and related components).

References

Community reviews

Loading reviews…