CVE-2024-12086VulnerabilityPublished 26 May 2026Updated 9 Oct 2026

Red Hat Security Advisory: rsync security update

Affects Red Hat rsyncSource GCVE Database

Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 30 Oct 2026, 11:52 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 1.7% chance of exploitation in 30 days – higher than 78% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 26 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux AppStream EUS (v.9.6) Red Hat Enterprise Linux BaseOS EUS (v.9.6) noarch Red Hat Discovery Red Hat Discovery 2 amd64 registry.redhat.io/discovery/discovery-server-rhel9@sha256:6a26bc89c61e7fad594399ceda8e170d66fa241d818eada7a12d9fec6bb08ecc_amd64 0	Fixed in–

AI-suggested

Red Hat has released updated rsync packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that address these vulnerabilities. Users should apply these official security updates as detailed in Red Hat advisory RHSA-2026:20603. The advisory provides package names and instructions for updating. No additional mitigations are specified or required beyond applying the vendor-provided patches.

Description

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

Impact

Successful exploitation of CVE-2024-12086 could lead to unauthorized disclosure of arbitrary client files from the rsync server, impacting confidentiality. CVE-2025-10158's out-of-bounds array access could cause crashes or undefined behavior, potentially leading to denial of service. CVE-2026-41035's use-after-free vulnerability in extended attribute handling could also lead to memory corruption and denial of service. There is no indication of known exploits in the wild. The overall impact is rated as high due to the confidentiality breach and potential service disruption.

Summary

The rsync utility in Red Hat Enterprise Linux 9.6 Extended Update Support and related distributions contains multiple vulnerabilities: CVE-2024-12086 allows the rsync server to leak arbitrary client files; CVE-2025-10158 involves an out-of-bounds array access via a negative index; and CVE-2026-41035 is a use-after-free vulnerability in extended attribute handling. These vulnerabilities have been fixed in updated rsync packages provided by Red Hat. The advisory RHSA-2026:20603 details the fixes and affected product variants. The CVSS vector for CVE-2024-12086 indicates network attack vector with high confidentiality impact but no integrity or availability impact. Red Hat recommends applying the updated packages to remediate these issues.

CWE-390Detection of Error Condition Without Action (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product detects a specific error, but takes no actions to handle the error.
Implementation
Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
Implementation
If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.
Testing
Subject the product to extensive testing to discover some of the possible instances of where/how errors or return values are not handled. Consider testing techniques such as ad hoc, equivalence partitioning, robustness and fault tolerance, mutation, and fuzzing.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Logging (opens in a new tab)
Error Handling (opens in a new tab)
OWASP ASVS 4.0.3
V11.1.8 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-129Improper Validation of Array Index (opens in a new tab)
Variant weaknessLikelihood of exploit: HighOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Architecture and Design · Input Validation
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overflow Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-805Buffer Access with Incorrect Length Value (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overflow Buffers (opens in a new tab)
SOAP Array Overflow (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-190Integer Overflow or Wraparound (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V5.4.3 (opens in a new tab)
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
Attack patterns
Forced Integer Overflow (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-179Incorrect Behavior Order: Early Validation (opens in a new tab)
Base weakness
The product validates input before applying protection mechanisms that modify the input.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Using Leading 'Ghost' Character Sequences to Bypass Input Filters (opens in a new tab)
Exploiting Multiple Input Interpretation Layers (opens in a new tab)
Using Unicode Encoding to Bypass Validation Logic (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-178Improper Handling of Case Sensitivity (opens in a new tab)
Base weakness
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
Architecture and Design · Input Validation
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-617Reachable Assertion (opens in a new tab)
Base weakness
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1286Improper Validation of Syntactic Correctness of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
SQL Injection (opens in a new tab)
NoSQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-838Inappropriate Encoding for Output Context (opens in a new tab)
Base weakness
The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
Implementation · Output Encoding
Use context-aware encoding. That is, understand which encoding is being used by the downstream component, and ensure that this encoding is used. If an encoding can be specified, do so, instead of assuming that the default encoding is the same as the default being assumed by the downstream component.
Architecture and Design · Output Encoding
Where possible, use communications protocols or data formats that provide strict boundaries between control and data. If this is not feasible, ensure that the protocols or formats allow the communicating components to explicitly state which encoding/decoding method is being used.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Content Security Policy (opens in a new tab)
OWASP ASVS 4.0.3
V14.4.6 (opens in a new tab)
V14.4.4 (opens in a new tab)
V14.4.2 (opens in a new tab)
Attack patterns
Generic Cross-Browser Cross-Domain Theft (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.3 (opens in a new tab)
V11.1.6 (opens in a new tab)
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Race Conditions via Symbolic Links (opens in a new tab)
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-126Buffer Over-read (opens in a new tab)
Variant weakness
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-208Observable Timing Discrepancy (opens in a new tab)
Base weakness
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
Attack patterns
Cross-Domain Search Timing (opens in a new tab)
Application Fingerprinting (opens in a new tab)
System Footprinting (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
V5.2.2 (opens in a new tab)
Attack patterns
Command Delimiters (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-131Incorrect Calculation of Buffer Size (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not correctly calculate the size to be used when allocating a buffer.
Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input…
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles…
Implementation · Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Attack patterns
Overflow Buffers (opens in a new tab)
Buffer Overflow via Parameter Expansion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-78Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #9OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
Architecture and Design · Attack Surface Reduction
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
OWASP Cheat Sheets
Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OS Command Injection Defense (opens in a new tab)
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.5 (opens in a new tab)
V5.3.8 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Command Line Execution through SQL Injection (opens in a new tab)
Command Delimiters (opens in a new tab)
Exploiting Multiple Input Interpretation Layers (opens in a new tab)
Argument Injection (opens in a new tab)
OS Command Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
OWASP Cheat Sheets
Logging (opens in a new tab)
Error Handling (opens in a new tab)
OWASP ASVS 4.0.3
V11.1.7 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-191Integer Underflow (Wrap or Wraparound) (opens in a new tab)
Base weakness
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-130Improper Handling of Length Parameter Inconsistency (opens in a new tab)
Base weakness
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Implementation
When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
Implementation
Do not let the user control the size of the buffer.
Implementation
Validate that the length of the user-supplied data is consistent with the buffer size.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Buffer Overflow via Parameter Expansion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
OWASP Cheat Sheets
XML Security (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
REST Assessment (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.2 (opens in a new tab)
V3.5.3 (opens in a new tab)
V13.2.6 (opens in a new tab)
Attack patterns
Padding Oracle Crypto Attack (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-475Name not in the CWE catalogue (opens in a new tab)
CWE-170Name not in the CWE catalogue (opens in a new tab)
CWE-295Name not in the CWE catalogue (opens in a new tab)
CWE-825Name not in the CWE catalogue (opens in a new tab)
CWE-193Name not in the CWE catalogue (opens in a new tab)
CWE-205Name not in the CWE catalogue (opens in a new tab)
CWE-354Name not in the CWE catalogue (opens in a new tab)
CWE-201Name not in the CWE catalogue (opens in a new tab)
CWE-289Name not in the CWE catalogue (opens in a new tab)
CWE-915Name not in the CWE catalogue (opens in a new tab)
CWE-1333Name not in the CWE catalogue (opens in a new tab)
CWE-407Name not in the CWE catalogue (opens in a new tab)
CWE-1204Name not in the CWE catalogue (opens in a new tab)
CWE-824Name not in the CWE catalogue (opens in a new tab)
CWE-1050Name not in the CWE catalogue (opens in a new tab)

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 12:53 UTC

WeaknessesCWE-390, CWE-129, CWE-805 +32

Technical details

References

Community reviews

Related threats