Threat database

Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit rendering engine, affecting Red Hat Enterprise Linux 9.6 Extended Update Support. These include arbitrary JavaScript execution in PDF.js, process crashes, memory corruption, sandbox escape, data leakage, and clipboard hijacking caused by maliciously crafted web content. The issues pose risks such as unexpected process termination, unauthorized access to restricted content, disclosure of sensitive information, and silent data theft. Red Hat has released security updates addressing these vulnerabilities.

A vulnerability identified as CVE-2026-68312 affects Microsoft software version 3.0. It involves a resource leak (cifsFileInfo) occurring on kmalloc failure during deferred close drain paths. No CVSS score or detailed impact information is provided.

A memory corruption vulnerability exists in libkcapi's one-shot asynchronous I/O (AIO) path, where an error can cause the library to return before all submitted I/O control blocks (IOCBs) are drained. This allows subsequent kernel writes into caller-owned output buffers, potentially leading to memory corruption. The vulnerability is tracked as CVE-2026-71226 and has a CVSS 3.1 base score of 7.3 (high severity). Red Hat has released security updates addressing this issue in libkcapi version 1.5.1-0.1.hum1 and related packages.

A directory traversal vulnerability (CVE-2025-67030) exists in the extractFile method of the plexus-utils component used by javapackages-tools in Red Hat Enterprise Linux 8. This vulnerability could allow an attacker to write files outside the intended directory. Red Hat has issued an important security update for javapackages-tools to address this issue.

A heap buffer overflow vulnerability exists in the read_channel_data() function of GIMP (GNU Image Manipulation Program), as addressed in Red Hat Enterprise Linux 9 updates. This flaw is identified as CVE-2026-58379 and has been rated with an important security impact by Red Hat Product Security. The vulnerability could potentially lead to memory corruption issues. Red Hat has released security updates for multiple architectures and variants of Red Hat Enterprise Linux 9 to address this issue.

A security vulnerability (CVE-2026-8450) exists in the perl-HTTP-Daemon package used in Red Hat Enterprise Linux 9. The flaw allows arbitrary code execution via OS command injection in the send_file() function of the HTTP::Daemon class. Red Hat has issued an important security update to address this issue.

CVE-2026-14330 is a vulnerability involving multiple unbounded alloca() calls in the PulseAudio protocol server component of PipeWire, a multimedia server for Linux. This flaw can lead to a stack overflow condition. The vulnerability has a CVSS score of 5.5 (medium severity) and impacts availability but not confidentiality or integrity. Red Hat has issued a security advisory with an update for PipeWire in Red Hat Enterprise Linux 9 to address this issue.