Threats affecting pkg:github/Grid Community Toolkit

CVE-2026-123975 is a high-severity heap out-of-bounds write vulnerability in Grid Community Toolkit versions before 6.2.20261111 and globus-gss-assist before 12.9. It occurs in the function globus_gss_assist_token_get_fd() when processing SSLv2 record lengths below 3. Remote unauthenticated attackers can exploit this by sending crafted GSI handshake records to services such as globus-gatekeeper and myproxy, causing heap corruption and service crashes. A fix is available in versions 6.2.20261111 and 12.9.