UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.
CVE-2026-111167 is a medium severity out-of-bounds read vulnerability in GNU LibreDWG up to version 0.14.8612. It occurs in the AcDs decoder function acds_private() due to an unchecked schema property type index, allowing attackers to read beyond a static table. Crafted R2004 or R2010+ DWG files with large 'schdat' property type values can trigger this flaw, potentially crashing applications like dwgread or dwg2dxf that use LibreDWG.
GNU Aspell version 0.60.8.2 contains a heap-based buffer overflow vulnerability in its read-only dictionary loader. The flaw arises from improper handling of size fields in a .rws dictionary header, allowing crafted dictionary files to trigger out-of-bounds writes. This can lead to heap memory corruption, causing denial of service or potentially arbitrary code execution. The issue is fixed in a commit identified as b830b6e and will be addressed in release 0.60.8.3.
GNU Emacs versions before 31.2, including TRAMP through 2.8.2, contain a vulnerability that allows OS command injection via crafted filenames. This occurs because the tramp-user-regexp filter has an incomplete list of disallowed inputs, resulting from an incomplete fix for a previous vulnerability (CVE-2026-79992). The vulnerability has a high severity rating with a CVSS score of 7.8.
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function that causes heap corruption when loading a personal wordlist with words whose length is a multiple of 256. This can lead to denial of service if a user runs aspell with a crafted personal wordlist. The issue is fixed in version 0.60.8.3.
GNU Aspell contains an out-of-bounds read vulnerability in the ReadOnlyDict::load() function within readonly_ws.cpp. This occurs when loading a binary .rws dictionary file, where offset fields from the file header are used as byte indices into a heap buffer without proper bounds validation. An attacker can exploit this by supplying a crafted dictionary file via --master, --dict-dir, or configuration options, potentially causing heap memory disclosure or a denial of service through application crash. This vulnerability is fixed in version 0.60.8.3.
GNU Aspell's prezip-bin component contains a heap-based buffer overflow vulnerability in its decompressor due to improper buffer space checks. This flaw allows crafted compressed files to cause out-of-bounds read and write operations on the heap, potentially leading to process crashes. The issue is fixed in version 0.60.8.3.
CVE-2026-97876 is a vulnerability in GNU grub2 where a local attacker with control over GRUB's configuration can bypass Secure Boot lockdown restrictions. This is due to insufficient validation of the MMIO base address passed to the GRUB serial command, allowing loading of unsigned GRUB modules while lockdown appears enabled.
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
GNU libextractor versions before 1.16 contain an untrusted search path vulnerability. The software loads plugins from a directory specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin, which may execute arbitrary code with elevated privileges when loaded by a setuid or setgid program.
GNU Emacs versions 28.1 through 31.1 contain a vulnerability that allows arbitrary code execution when opening a file. This occurs because an untrusted value of the read-symbol-shorthands variable influences the intern and unintern functions, affecting the default configuration without requiring special user settings.
A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.
CVE-2026-95818 is a stack-based buffer overflow vulnerability in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44. This flaw affects setuid/setgid programs that use DT_RPATH or DT_RUNPATH beginning with $ORIGIN followed by a NUL or '/' character. Exploitation can cause the loader to read and write beyond the bounds of internal buffers, leading to crashes or limited disclosure of process memory. The vulnerability has a low CVSS score of 3.6 and requires local attacker privileges with high attack complexity.
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.
Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.
CVE-2026-8674 is a reachable assertion vulnerability in the GNU C Library (glibc) affecting versions 2.26 through 2.44. It occurs when the DNS stub resolver initializes from an /etc/resolv.conf file or LOCALDOMAIN environment variable with a search list containing a domain roughly 200 characters or longer. This triggers an assertion failure that aborts the process. The flaw arises because the resolver truncates the search list into a fixed-size buffer but performs a consistency check against the wrong size, causing a valid truncated list to fail the assertion. Any process performing name resolution via glibc is affected, including long-running processes that reload /etc/resolv.conf after changes. Attackers on the local network may trigger this without privileges, leveraging DHCP or VPN server configurations that update search domains.
CVE-2026-80489 is a medium severity vulnerability in the GNU C Library (glibc) versions 2.3 through 2.44. It involves an infinite loop condition when converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, such as via iconv. The flaw occurs because the converter improperly handles certain two-code-point sequences when the output buffer is too small, causing the application to hang indefinitely. This affects only the EUC_JISX0213 character set, which is uncommon.
CVE-2026-91780 is a medium severity vulnerability in GNU Binutils 2.47 involving a null pointer dereference in the elf_link_add_object_symbols function within bfd/elflink.c. The issue requires local access to exploit and no user interaction. Public exploit code is available, but no vendor response or patch has been issued yet.
CVE-2026-91779 is a medium severity vulnerability in GNU Binutils 2.47 affecting the Eh Frame Handler component. It involves a NULL pointer dereference in the _bfd_elf_eh_frame_section_offset function. The flaw requires local access to exploit and no user interaction. Public exploit code is available, but no official vendor response or patch has been confirmed yet.
A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.48 addresses this issue. The patch is identified as d1268210b6f6/471130b39c0/283d3198bed/0a84e560216/a692a633d40. Upgrading the affected component is recommended.
A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 is able to address this issue. The identifier of the patch is 7322e9bc30cb282575a701c307851fd3d66fee68. It is suggested to upgrade the affected component.