FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.
A vulnerability in MIT Kerberos 5's clnttcp_call() function in Red Hat Enterprise Linux 10 causes a memory leak in GSS-RPC client programs by not freeing the RPC reply verifier between retries. This can be exploited by remote attackers who control an RPC endpoint or intercept client network traffic to cause a denial of service through resource exhaustion. The flaw affects client-side RPC processing only and does not impact authentication servers or default daemon operations. Exploitation requires continuous malformed responses during an active transaction and does not compromise data integrity or confidentiality. Red Hat rates this vulnerability as Moderate and currently has no effective mitigation that meets their criteria.
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112320 is a vulnerability in the GSS-RPC transport layer of MIT Kerberos 5 (krb5) 1.4 and later, affecting Red Hat Enterprise Linux 10. It occurs because the system does not release the previous authentication context when a client switches from a GSS authentication flavor to a non-GSS flavor on the same TCP connection. This flaw allows unauthenticated remote attackers to cause a denial of service by exhausting memory in the kadmind service through repeated establishment and abandonment of GSS authentication contexts.
CVE-2026-112319 is a vulnerability in the GSS-RPC layer of MIT Kerberos 5 used in Red Hat Enterprise Linux 10. It allows remote authenticated users to cause a denial of service by triggering unbounded memory allocations during XDR decoding of crafted RPC requests. This leads to memory exhaustion or excessive CPU consumption in the Kerberos administration daemon (kadmind). Exploitation requires valid Kerberos authentication and affects process availability without compromising data confidentiality or integrity.
CVE-2026-112318 is a denial of service vulnerability in the MIT Kerberos 5 kadmind service used in Red Hat Enterprise Linux 10. The flaw occurs because the policy RPC stubs do not reject a NULL policy name, leading to a NULL pointer dereference and crash of the kadmind daemon when a remote authenticated user sends a crafted policy request with an empty policy name. This disrupts administrative operations but does not affect standard ticket-granting or authentication services.
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112317 is a vulnerability in MIT Kerberos 5 (krb5) versions 1.2.8 and later, affecting Red Hat Enterprise Linux 10. The flaw occurs in the krb5_ktkdb_get_entry() function, which fails to free decrypted key material when a post-decryption check fails. This leads to a memory leak in the Key Distribution Center (KDC) or kadmind services, allowing unauthenticated remote attackers to cause a denial of service by exhausting service memory through repeated malformed requests.
CVE-2026-112315 is a vulnerability in the RPCSEC_GSS authentication routines of MIT Kerberos 5 used in Red Hat Enterprise Linux 10. It causes a memory leak in the kadmind service due to failure to free partially decoded buffers on error. This can be exploited remotely by unauthenticated attackers sending crafted RPCSEC_GSS messages, leading to denial of service by resource exhaustion. The impact is limited to environments where Kerberos administrative RPC interfaces are exposed to untrusted networks.
CVE-2026-12977 is a vulnerability in Red Hat Fuse 7 involving the WildFly Core deployment-operation handlers. The flaw allows an administrator with the restricted "Maintainer" role to bypass role-based access control (RBAC) and read sensitive configuration files. This can lead to credential exfiltration and full administrative (SuperUser) control of the server, enabling actions such as deploying malicious code or altering audit logs. No official fix or mitigation meeting Red Hat's criteria is currently available.
A malicious file identified by the SHA-256 hash 8f4ebfb87e11d0829e458ddc0f795fc2f1800dd16c7f705cf05fbd95b7bceab9 was observed twice on November 9, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Finland. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A race condition vulnerability (CWE-362) exists in SuperTokens Core authentication server versions from 7.0.0 up to various fixed versions below 12.3.1. The flaw allows a user controlling a linked login method to retain a signed, refreshable session as the former primary identity after unlinking that login method. This session persists until expiry or explicit revocation. The issue is fixed in multiple versions starting from 11.0.9 through 12.3.1.