This advisory covers multiple security issues affecting Red Hat Discovery and the underlying glibc libraries in Red Hat Enterprise Linux 9. The key vulnerability CVE-2025-15281 involves the glibc wordexp function potentially returning uninitialized memory when used with WRDE_REUSE and WRDE_APPEND flags. Additional vulnerabilities include an integer overflow in memalign leading to heap corruption (CVE-2026-0861) and information disclosure via zero-valued network queries (CVE-2026-0915). Red Hat has issued patches for glibc in RHEL 9 to fix these vulnerabilities. Red Hat Discovery itself is a tool that inspects and reports environment data, including system counts and configurations. The advisory includes multiple CVEs related to glibc and other components but does not specify direct fixes for Discovery beyond container updates. The vendor advisory references official errata and documentation for applying updates.

The vulnerabilities affect the standard C library (glibc) used by Red Hat Enterprise Linux 9 and related products, potentially leading to heap corruption, information disclosure, and memory safety issues. These could impact system stability and confidentiality of information processed by affected functions. Red Hat Discovery uses these libraries and may be indirectly affected. No active exploitation in the wild has been reported. The overall security impact is rated moderate to important by Red Hat, with a high severity classification noted in the input data.

Red Hat has released official patches for glibc in Red Hat Enterprise Linux 9 to address the identified vulnerabilities. Users should apply the updates as detailed in Red Hat advisory RHSA-2026:2786 and RHSA-2026:4501. The containers for Red Hat Discovery can be installed or updated via the discovery-installer RPM as per official documentation. There are no indications that additional mitigations beyond applying these updates are required. Patch status is confirmed by the vendor advisories linked.