CVE-2026-92824: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. The flaw occurs in the module stream v2 rpm-map emission path, where an inner loop incorrectly uses the count of digest algorithms instead of the number of checksums, leading to a potential crash and denial of service during YAML serialization of crafted metadata.
CVSS v3.1
Score 6.2medium
Affected software
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Hardened Images
Red Hat
Red Hat OpenShift Container Platform 4
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libmodulemd affects Red Hat Enterprise Linux 10. Specifically, in the module stream v2 rpm-map emission path, the code uses the count of digest algorithms as the loop bound rather than the number of checksums in the current digest table. When processing specially crafted modulemd v2 metadata containing multiple digest types, this can trigger an out-of-bounds read during YAML serialization. The typical result is a crash causing denial of service. The CVSS 3.1 score is 6.2 (medium severity) with local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.
Potential Impact
Successful exploitation causes an out-of-bounds read that typically leads to a crash of the affected process, resulting in denial of service. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92824 for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-16T20:31:32.419Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-92824","vendor":"Red Hat"}]
Threat ID: 6ad836272cdf04f656a1302a
Added to database: 10/21/2026, 03:48:55 UTC
Last enriched: 10/21/2026, 04:03:44 UTC
Last updated: 10/21/2026, 04:08:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.