A denial of service vulnerability (CVE-2026-95512) exists in the FreeType font rendering library's CID font loader due to repeated subroutine allocations. Red Hat has issued updated RPM packages for FreeType to address this issue in their Hardened Images. The vulnerability is rated medium severity. No active exploitation or detailed technical information about the flaw is provided. Updated FreeType packages version 2.14.3-2.1.hum1 are available from Red Hat.
A NULL pointer dereference vulnerability exists in the SSL_CIPHER_find() function when handling an unknown cipher ID in Microsoft software version 3.0. This can cause the affected software to crash or behave unexpectedly due to improper handling of null references.
A vulnerability exists in the TS_RESP_verify_response() function due to missing validation of ASN1_TYPE data. This issue affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided. No patch or remediation details are available at this time.
A heap out-of-bounds write vulnerability exists in the BIO_f_linebuffer component affecting Microsoft product version 3.0. This flaw involves improper handling of short writes, potentially leading to memory corruption.
CVE-2025-66199 is a vulnerability in Microsoft software version 3.0 involving excessive memory allocation triggered by the TLS 1.3 CompressedCertificate feature. This flaw relates to improper handling of memory resources during TLS certificate compression, potentially leading to resource exhaustion. No CVSS score or detailed impact metrics are provided. No patch or remediation details are currently available.
A vulnerability identified as CVE-2025-15469 affects the 'openssl dgst' one-shot codepath, where inputs larger than 16MB are silently truncated. This issue is present in Microsoft product version 3.0. No CVSS score or detailed impact information is provided, and no patch or remediation details are available.
A NULL pointer dereference vulnerability exists in the PKCS12_item_decrypt_d2i_ex function in Microsoft software version 3.0. This flaw could cause the affected software to crash or behave unexpectedly when processing certain inputs. No CVSS score or detailed impact information is provided. There is no information about available patches or vendor advisories addressing this issue.
CVE-2026-22796 is a type confusion vulnerability in the PKCS7_digest_from_attributes() function of Microsoft software version 3.0. The flaw involves ASN1_TYPE type confusion, which can lead to unexpected behavior in the affected function.
A vulnerability identified as CVE-2026-22795 involves missing ASN1_TYPE validation during PKCS#12 parsing in Microsoft software version 3.0. This flaw relates to improper validation of ASN.1 data structures, which could potentially lead to security issues. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches at this time.
This vulnerability involves the ALSA dummy driver failing to properly check the validity of the card index during the probe process. It affects specific versions of the Microsoft product listed. The severity is assessed as medium. No CVSS score or detailed technical impact is provided. No known exploits are reported in the wild. No patch or remediation information is available from the vendor advisory.
This vulnerability involves a fix to the UVD dpb minimum size calculation for H264 in the drm/amdgpu driver. It affects specific versions of the Microsoft product listed. The severity is assessed as medium. No CVSS score is provided. There is no information about active exploitation or patch availability in the provided data.
A medium severity vulnerability identified as CVE-2026-80884 affects specific versions of Microsoft software. The issue relates to the handling of DMA addresses, with a fix available. The vulnerability is addressed by patches released by the vendor. The vendor advisory references multiple Linux kernel security fixes, including issues affecting AMD processors and various subsystems, indicating a broad security update context. No known exploits are reported in the wild.
A vulnerability exists in Microsoft software related to incorrect handling of the transport header when sending VLAN-tagged network frames. This issue affects specific versions of the Microsoft product listed and has been assigned CVE-2026-80906. The severity is assessed as medium. No CVSS score is provided. There is no explicit information about available patches or remediation in the provided data.
A vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem involved missing handling of fbcon state updates during certain display mode changes. The issue was addressed by wrapping user-invoked calls to fb_set_var() in a helper function that ensures fbcon is properly checked and updated during mode changes. This fix prevents inconsistencies in hardware state and fbcon state maintenance, particularly affecting drivers like ps3fb and sh_mobile_lcdcfb.
This vulnerability involves the power supply component max17040 and relates to synchronizing work cancellation during system suspend. It affects specific versions of Microsoft-related software. The severity is assessed as medium. No CVSS score is provided, and no known exploits are reported in the wild. Patch status is not confirmed due to lack of vendor advisory or patch information.
A use-after-free vulnerability exists in the flow mask handling of Open vSwitch in certain Microsoft-related versions. This flaw occurs during flow deletion, potentially leading to memory corruption. The issue has been assigned CVE-2026-80994 and is rated with medium severity. The affected versions are specific builds of Open vSwitch 4.4.0. No CVSS score is provided.
This vulnerability involves the SCTP (Stream Control Transmission Protocol) implementation where processing of a packet continues even after its association has been deleted. This could potentially lead to unexpected behavior or resource issues. The issue affects specific Microsoft-related versions listed. The severity is assessed as medium based on available information. No CVSS score or detailed impact analysis is provided.
This vulnerability involves an underflow issue in the SCTP protocol implementation related to handling duplicate RECONF responses, which can affect specific Microsoft software versions. The issue is identified as medium severity. No CVSS score is provided. The affected versions are explicitly listed. There is no information about available patches or vendor advisories in the provided data.
A vulnerability in the Linux kernel's mailbox driver (mchp-ipc-sbi) was addressed by adding a null check for the devm_kasprintf() function. The fix ensures that if devm_kasprintf() returns NULL, the function mchp_ipc_get_cluster_aggr_irq() returns an error (-ENOMEM) instead of proceeding with a null pointer. This prevents potential issues caused by dereferencing a NULL pointer.