CVE-2026-111132 is a heap out-of-bounds read vulnerability in GNOME libgxps versions up to 0.3.2. It occurs in the path_geometry_start_element() function when processing crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes in XPS documents. An attacker can supply a point count not divisible by three or two, causing a read past allocated memory, potentially crashing applications like Evince and leaking adjacent heap memory.
A vulnerability in GNOME evolution-data-server allows unauthorized exposure of sensitive information. Calendar events with a file:// URI in their ATTACH property cause the client to read and base64-encode local files, then upload them to the server when the event is saved. There are no restrictions on file paths or verification of attachment origin, enabling attackers with access to a shared CalDAV calendar to exfiltrate arbitrary files accessible to the user. This affects versions from 3.26 up to but not including 3.62.1. The vulnerability has a medium severity score of 5.7.
CVE-2026-91838 is a high-severity OS command injection vulnerability in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this flaw by inserting shell metacharacters into VPN profile fields, which are then passed unescaped to the pppd daemon running as root. This allows arbitrary command execution with elevated privileges when the malicious VPN connection is activated.
CVE-2026-91841 is a local privilege escalation vulnerability in NetworkManager-vpnc, a VPN plugin for NetworkManager. It allows a local unprivileged user to inject newline characters into the CA-File path, enabling execution of arbitrary commands as root. This vulnerability has a high severity rating with a CVSS score of 7.8. It affects all versions of NetworkManager-vpnc starting from version 0. No known exploits are reported in the wild. A vendor advisory from Red Hat is available but does not explicitly state patch status.
CVE-2026-91840 is a vulnerability in GNOME NetworkManager-vpnc that allows a local unprivileged user to escalate privileges to root. The flaw arises from improper neutralization of CRLF sequences, enabling an attacker to inject newline characters into the VPN username field. This injection manipulates the vpnc configuration, causing arbitrary programs to execute with root privileges when the malicious VPN connection is activated. The vulnerability has a high severity rating with a CVSS score of 7.8.
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.
CVE-2026-91837 is a local privilege escalation vulnerability in NetworkManager-iodine, a VPN plugin for NetworkManager. It arises from improper neutralization of special shell characters in the 'nameserver' setting, allowing a local unprivileged user to inject OS commands. These commands execute with root privileges before the application drops elevated permissions, enabling arbitrary command execution as root.
CVE-2026-97222 is a medium severity heap use-after-free vulnerability in GNOME Gnumeric. It is triggered when a user opens a specially crafted workbook containing a malformed SheetObjectComponent element, causing the XML parser to dereference a freed sheet-object component and crash the application. This affects Gnumeric versions 1.11.0 and later. The vulnerability has a CVSS score of 5.5 and does not impact confidentiality or integrity but causes availability disruption due to application crashes.
CVE-2026-92248 is a high-severity vulnerability in the GIMP image editor's file-psd plugin. It involves an integer overflow during thumbnail preview generation for specially crafted PSD files, leading to a heap-based buffer overflow. This flaw can cause application crashes or allow arbitrary code execution. Red Hat has issued an important security update addressing this issue in GIMP packages for Red Hat Enterprise Linux 9.
CVE-2026-88924 is a local privilege escalation vulnerability in the GNOME gvfs package. It arises from a TOCTOU race condition in the gvfsd-admin daemon, which improperly changes ownership of files by following symbolic links in user-controlled directories. This flaw allows a local authenticated attacker to change ownership of critical root-owned files, potentially leading to full root access. The vulnerability affects multiple versions of gvfs prior to fixed releases. Red Hat has issued an important security update addressing this issue.
CVE-2026-84267 is a vulnerability in the SFTP backend of GNOME gvfs where a malicious SFTP server can cause the client to leak uninitialized heap memory. This occurs because the read_string() function allocates a buffer without verifying it is fully filled, leading to uninitialized bytes being used as a file handle and echoed back to the server. The leaked memory includes the heap base and the load address of the libgio library, allowing deterministic defeat of ASLR. The vulnerability requires user interaction to connect to a malicious SFTP share and results in limited information disclosure without exposing user data. It has been rated with moderate severity and affects gvfs versions from 1.10.0 up to but not including 1.60.2.
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
A heap-based buffer overflow vulnerability exists in the SFTP backend of GNOME gvfs. A malicious SFTP server can cause the gvfsd-sftp process to write beyond allocated buffer boundaries during file read operations, potentially leading to process crash or arbitrary code execution. Exploitation requires a user to connect to a malicious SFTP share. Default security features like SELinux, ASLR, and NX mitigate the risk of arbitrary code execution.
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of memory contents.
CVE-2026-82330 is a heap out-of-bounds read vulnerability in the file-pvr plugin of GIMP 3.2.0. It occurs when processing specially crafted PVR image files due to missing memory bounds checks in the VQ compressed decoder. This flaw can cause application crashes leading to denial of service or limited disclosure of heap memory contents. Exploitation requires convincing a user to open a malicious PVR file, reducing the likelihood of attack. The vulnerability has a medium severity rating with a CVSS score of 6.1. No official fix or patch is currently confirmed by the vendor. The recommended mitigation is to avoid opening PVR files from untrusted sources.
CVE-2026-82328 is a medium severity vulnerability in the file-ico plugin of GNOME GIMP. It involves improper validation of the used_clrs (palette count) parameter when processing specially crafted ICO image files, leading to a heap out-of-bounds read. This can cause the application to crash, resulting in denial of service, or potentially disclose limited heap memory contents. Exploitation requires convincing a user to open a malicious ICO file, reducing the likelihood of attack. No official fix or patch status is confirmed yet. The vendor recommends avoiding opening ICO files from untrusted sources as a mitigation.
CVE-2026-82324 is a medium severity vulnerability in the file-iff (IFF/ILBM) plugin of GIMP version 3.0.0. It arises from improper validation of the HAM row size and incorrect handling when the number of color planes (nPlanes) is zero, causing a row size mismatch that leads to heap out-of-bounds reads. This flaw can cause the application to crash, resulting in denial of service, or potentially disclose limited heap memory contents. Exploitation requires a user to open a specially crafted IFF/ILBM image file, which reduces the likelihood of attack. The vendor advisory recommends not opening untrusted IFF/ILBM files with GIMP as a mitigation. No official patch or fix status is confirmed in the advisory.