AISLE CVE Discoveries

Heap out-of-bounds write in the APAC decoder via an unreset bitstream index

Heap buffer overflow in LCEVC enhancement decoding via unvalidated output dimensions

Integer overflow in the prores_ks encoder causing heap buffer overflow on large frames

Heap buffer overflow in the GIF encoder via a PAL8 frame linesize that grows mid-stream

Out-of-bounds write in the VVC decoder's sh_entry_points() via excess entry points

Heap buffer overflow in dvbsub_encode() from undercounted CLUT segment headers

Out-of-bounds read and write in the Huffyuv encoder median predictor via tiny frames

Heap buffer overflow in the DVD subtitle encoder via odd-width bitmap subtitle rectangles

Heap buffer overflow in the Cook multichannel decoder via overlapping channel masks

Double free in cbs_sei_delete_message() via a stale extension_data reference

Heap buffer overflow in the EXR encoder RLE path when frame height grows mid-stream

Off-by-one heap overflow in get_exponent_dynamic() of the Nellymoser trellis search

Heap buffer overflow in ff_llvidenc_diff_bytes_rvv() via RGB video narrower than 8 pixels

Integer overflow in the VVC decoder's alloc_frame() causing heap overflow on 32-bit builds

Integer overflow in ff_vk_decode_add_slice() causing heap overflow on huge slice data

Integer overflow in the FFV1 Vulkan encoder undersizing the float remap buffer

Heap buffer overflow in the FLIC decoder via one-sided bounds check in check_pixel_ptr()

Heap buffer overflow in ff_dxva2_hevc_fill_picture_parameters() via excessive HEVC tiles

Heap buffer overflow in the QSV encoder when input resolution grows mid-stream

Integer overflow in cbs_jpeg_write_scan() causing heap buffer overflow on 32-bit builds

Integer overflow in hap_parse_frame_header() causing heap buffer overflow on 32-bit builds

Heap buffer overflow in vdpau_hevc_start_frame() via excessive HEVC tile columns or rows

Heap buffer overflow in the APNG encoder encode_apng() when frame size grows mid-stream

Heap buffer overflow in pcm_bluray_decode_frame() on big-endian hosts via odd LPCM lengths

Heap buffer overflow in the PSD decoder on 32-bit builds via overflowing dimensions

Heap buffer overflow in the VideoToolbox encoder when input resolution grows mid-stream

Invalid free in aribcaption_trans_ass_subtitle() cleanup via an oversized caption region

Heap buffer overflow in aribcaption_trans_text_subtitle() via zero caption regions

Out-of-bounds write in v4l2_buffer_swframe_to_buf() via unchecked cumulative plane offsets

Heap buffer overflow in ff_libwebp_get_frame() via mid-stream resolution increase

Heap buffer overflow in vaapi_hevc_start_frame() via unbounded PPS tile counts

Heap out-of-bounds write in vk_av1_decode_slice() via an AV1 stream with over 256 tiles

Heap buffer overflow in liboapve_encode() via frames larger than the encoder dimensions

Out-of-bounds write in the FLIC decoder via a non-terminating FLI_BRUN byte-swap loop

Out-of-bounds read in the SGI encoder's encode_frame() via negative linesize frames

Heap out-of-bounds read in the LCL decoder via an integer underflow on short ZLIB packets

Out-of-bounds read in bitpacked_decode_uyvy422() via truncated packets

Out-of-bounds heap read in tdsc_load_cursor() via oversized TDSC cursor dimensions

Out-of-bounds read in libxevd_receive_frame() via oversized EVC NAL length prefixes

Out-of-bounds read in the Musepack SV7 decoder via an oversized last frame length

CPU exhaustion in the JPEG XL parser via a huge toc_count in a permuted TOC

Division by zero in the VVC decoder via excess num_ref_idx_active in ff_vvc_slice_rpl()

Resource leak in svt_jpegxs_dec_decode() when ff_set_dimensions() rejects frame dimensions

Reachable assertion in libxevd_receive_frame() via EVC access units that produce no frame

Infinite loop in wavpack_encode_init() via integer overflow from a huge sample rate

Division by zero in estimate_motion_b() via B-frame timestamp gaps of 65536 multiples

NULL pointer dereference in the ADX decoder via an invalid sample rate in side data

Division by zero in the pcm_rechunk bitstream filter via an overflowing channel count

Excessive memory allocation in the SBaGen demuxer via a very high script sample rate

NULL pointer dereference in aac_adtstoasc_filter() via an oversized ADTS AAC packet

CPU exhaustion in the Vorbis parser from re-parsing large invalid extradata per packet

Uncontrolled recursion in the FLAC parser score_header() via many small frame headers

Deadlock in the Mimic decoder with frame threading when init_get_bits8() fails

NULL pointer dereference in the DPX encoder via 12-bit RGB input selecting encode_gbrp12()

Excessive memory allocation in the Interplay ACM decoder via an oversized block size

Memory exhaustion in the av1_frame_merge filter when no temporal delimiter OBU arrives

Memory leak in the libx265 encoder from unfreed Dolby Vision RPU payloads

Memory leak in vc1_decode_frame() when init_get_bits8() fails on oversized slices

Out-of-bounds read in pcm_dvd_encode_frame() via a short final 24-bit frame

Reachable assertion in the TTA encoder from unreserved CRC space in the output packet

Division by zero in ff_aom_parse_film_grain_sets() via repeated AFGS1 scaling points

CPU exhaustion in pps_3d_extension() via unbounded HEVC depth lookup table loops

Memory exhaustion in the EXIF parser via many IFD entries pointing at overlapping payloads

NULL pointer dereference in ff_hap_set_chunk_count() via an oversized Hap chunk count

Memory leak in libxevd_receive_frame() when an access unit produces no picture

Memory exhaustion in the APE decoder via an oversized nblocks value in legacy files

Infinite loop in bit_allocation() of the IMC/IAC decoder via a negative bit budget

NULL pointer dereference in tqi_decode_frame() via an oversized pIQT chunk

NULL pointer dereference in the Bink video decoder via an oversized frame

NULL pointer dereference in vble_decode_frame() via an oversized VBLE frame

NULL pointer dereference in the CLJR decoder via an oversized frame

NULL pointer dereference in tgv_decode_inter() via an oversized compressed block section

NULL pointer dereference in g726_decode_frame() via an oversized G.726 packet

Uninitialized stack memory disclosure in the CDXL decoder via unfilled HAM palette entries

Uninitialized heap disclosure in sunrast_decode_frame() via truncated paletted images

Uninitialized heap memory disclosure in the PCX decoder via truncated RLE scanlines

Uninitialized stack memory disclosure in the Go2Meeting decoder via a short Kempf palette

Heap out-of-bounds read in v4l2_buffer_swframe_to_buf() via frames with negative linesize

Use after free in the NVDEC decoder via a stale bitstream pointer after slice errors

Use after free in the MJPEG decoder via a SOF marker without a preceding SOI

Integer overflow in cbs_vp9_split_fragment() causing out-of-bounds read on 32-bit builds

Out-of-bounds read in the Vorbis encoder put_vector() via NaN float samples

Memory exhaustion via LCEVC enhanced output dimensions not checked against max_pixels

Division by zero in dovi_configure_ext() via a zero frame rate denominator

Memory leak in the VAAPI decoder via slice parse errors on every frame

Assertion failure in cbs_jpeg_assemble_fragment() via 0xff bytes in the scan header

Memory leak in ff_mjpeg_decode_sof() via an overwritten hwaccel_picture_private pointer

Memory leak in the VDPAU hwaccel bitstream buffer table via aborted pictures

Assertion abort in the DPX decoder after a failed Vulkan hwaccel callback

Memory leak in the VP9 decoder vp9_decode_frame() error paths via invalid tile sizes

NULL pointer dereference in ff_dovi_rpu_generate() via omitted Dolby Vision DM blocks

Deadlock in the V4L2 M2M decoder from a reference count leak on resolution changes

Reachable assertion in the lcevc_metadata filter via duplicate IDR or non-IDR NAL units

CPU exhaustion in the dts2pts bitstream filter via H.264 packets with many slices

NULL pointer dereference in the MPEG audio ADU decoder via an oversized packet

NULL pointer dereference in the JV video decoder via an oversized packet

NULL pointer dereference in the Motion Pixels decoder via an oversized packet

Uninitialized heap memory disclosure in the CineForm HD decoder via oversized ImageHeight

Uninitialized stack memory disclosure in old_codec23() of the SANM decoder

Uninitialized memory disclosure in dng_decode_tiles() via near-INT_MAX tile dimensions

Uninitialized memory disclosure in the JPEG-LS decoder via 16-bit line-interleaved scans

Memory leak in the VVC decoder alloc_frame() when frame buffer allocation fails

Uninitialized heap memory disclosure in the RoQ DPCM audio encoder via short audio streams

Uninitialized heap memory disclosure in the DXA decoder via a type 4 frame

Uninitialized stack memory disclosure in decode_mvc2() via out-of-range palette indices

Uninitialized heap disclosure in the CamStudio decoder via short decompressed payloads

Out-of-bounds read in the Cook decoder via an unchecked js_subband_start value

Uninitialized heap disclosure in the VQA decoder via a missing or truncated codebook chunk

Uninitialized heap memory disclosure in the MSCC/SRGC decoder via early-ending RLE data

Uninitialized memory read in the Flash Screen Video 2 decoder via mid-pixel truncated data

Uninitialized heap disclosure in the Flash Screen Video decoder via short inflate data

Uninitialized memory disclosure in targa_decode_rle() via truncated RLE-compressed images

Uninitialized heap memory disclosure in ff_mlz_decompression() via out-of-range codes

Uninitialized heap memory disclosure in the TAK decoder via incomplete decorrelation lists

Uninitialized heap memory disclosure in the VMnc decoder via an unwritten cursor save area

Integer overflow in the OpenEXR decoder tiled block count leading to memory disclosure

Uninitialized heap memory disclosure in the GEM raster decoder via SKIP or pattern opcodes

Uninitialized memory disclosure in the WebP decoder via a short uncompressed ALPH chunk

Uninitialized heap memory disclosure in raw_decode() via truncated low bit depth packets

Uninitialized stack memory disclosure in the Tiertex SEQ decoder via failed RLE unpacking

Uninitialized stack memory disclosure in the C93 decoder via a truncated color table

Out-of-bounds read in the prores_ks encoder via interlaced odd-height alpha

Memory leak in mediaformat_jni_setBuffer() leading to resource exhaustion on Android

Uninitialized heap disclosure in adpcm_encode_frame() via mono ADPCM_MS trellis encoding

Heap out-of-bounds read in the prores_aw encoder on interlaced odd-height frames

Quadratic CPU consumption in decode_sequence_of() from unauthenticated KDC requests

Memory exhaustion in kadmind as failed AUTH_GSSAPI_INIT requests retain client state

Quadratic CPU consumption in clean_client() when purging many AUTH_GSSAPI clients

Memory leak of decoded arguments in the AUTH_GSSAPI handler's AUTH_GSSAPI_INIT error paths

Memory leak in kadmind when a client switches from GSS to non-GSS RPC auth flavors

Memory leak in clnttcp_call() when retrying after RPC replies with mismatched XIDs

Unbounded memory allocation during XDR decoding of kadmind RPC requests

NULL pointer dereference in kadmind policy RPC handlers via an empty policy name

Memory leak in xdr_krb5_tl_data() when decoding fails on crafted kadmin RPC requests

Memory leak of decrypted key material in krb5_ktkdb_get_entry() on key decryption failures

Memory leak in kadmind from failed RPCSEC_GSS buffer decoding of unauthenticated messages

Denial of Service via unauthenticated userTenantId in multitenant mode

Memory exhaustion from unbounded TLS 1.3 session ticket retention in the client cache

Out-of-bounds read and write in the libstdc++ parallel search due to an undersized buffer

Integer wrap in the std::vector<bool> constructor leading to out-of-bounds access

Heap buffer overflow in the TrueType outliner from a point-count accounting error

Out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

MLS X.509 credential not bound to the LeafNode signature key

Code injection via a forged nocache marker in the extends: template inheritance cache

Integer overflow in mod_dav_fs via PROPPATCH requests declaring many XML namespaces

Remote code execution by drive-by website

Unbounded recursion parsing PDF page trees and trailer chains when appending

Memory exhaustion in the MSP RLE decoder from unbounded expansion of a small file

NULL pointer dereference in Image.merge() from an unvalidated first band

Out-of-bounds access in ImageMorph.MorphOp.apply() on a zero-width image

Invalid free in FreeType glyph rendering when FT_Load_Glyph fails with an active stroker

Heap use-after-free when libtiff rejects a tag while encoding TIFF to an in-memory buffer

Heap over-read in WMF/EMF rendering from 16-bit dimension truncation on Windows builds

Out-of-bounds read/write in bhyve's HDA audio device model via zero-length BDL entries

Race condition and missing resolution validation in bhyve's framebuffer device model

Race condition in bhyve's xHCI device model via guest-modified event ring size and TRBs

Out-of-bounds write in the TIFF CCITT T6 encoder via an undersized output buffer

Out-of-bounds histogram access in HistogramEqualization from non-finite luminance values

Out-of-bounds write in ICC LUT16 conversion via more than four output channels

Out-of-bounds write in the TIFF CCITT T4 encoder via an undersized output buffer

Disclosure of stale pooled memory in the EXR ZIP decoder after a short inflate

Uncontrolled loop on an attacker-declared BigTIFF IFD entry count stalls a decoder thread

Excessive allocation in ICC CLUT parsing from unvalidated channel and grid dimensions

Busy loop on retryable GnuTLS results in VNC TLS I/O handlers leading to denial of service

Heap buffer overflow in VNC TLS peek buffer handling on partial reads

Heap buffer overflow in the DIGEST-MD5 client via quoting-lengthened challenge fields

Denial of service when coalescing text nodes in html

SSH host verification bypass when a redirect leads to SFTP or SCP

FTP wildcard write callback mixup

Infinite loop bypassing transfer timeouts when a server omits the final response line

IMAP APPEND plus CRLF conversion command injection

Origin credentials sent to an HTTP proxy that answers CONNECT with 401 instead of 407

Stack overflow from unbounded recursion in curl_mime_free() on nested MIME parts

HSTS response erases persisted entries

HSTS cache import drops longer-lived child

FTP connection reuse inherits client-certificate

Cookie jar parsing aborted by an overlong cookie line written from a server-set cookie

Cookie jar replaced by an empty file after a server sets an unloadable cookie

Kerberos ticket sent to a foreign host after a redirect to a URL with userinfo

-J no-clobber guarantee bypassed with 103 early hints

TFTP direction confusion

Connection reuse ignoring the automatic client certificate option on Schannel redirects

Negotiate credentials sent to redirected origin

Authorization header leak when CURLOPT_AWS_SIGV4 is reset to NULL

Credentials leaked in the URL returned by CURLINFO_EFFECTIVE_URL

SQL Injection in the widget data API

SQL Injection in the contact lookup AJAX endpoint

Path traversal in the Asset API allowing arbitrary file read via local assets

Panics in JSON parsing

Panic during CBC-HMAC processing

HBAC authorization bypass via short-username collisions across trusted domains

Access control bypass via early exit from LDAP access rules on an expired-password warning

Memory exhaustion via abandoned IdP pre-authentication requests that are never cleared

Uninitialized pointer dereference in the PAM responder's passkey Kerberos handling

NULL pointer dereference on certificates lacking the SID extension in certificate mapping

Out-of-bounds write in the NFS idmap plugin when copying oversized cached names

Integer underflow in NSS responder packet header parsing causes an out-of-bounds read

Out-of-bounds read in the PAM responder on a zero-length authentication token

Unbounded negative cache growth in the NSS responder leading to memory exhaustion

Integer underflow in autofs responder packet length parsing causes an out-of-bounds read

Memory exhaustion in the KCM responder via repeatedly storing and destroying credentials

Missing authorization check lets unprivileged users force global autofs cache invalidation

Memory exhaustion in the autofs responder via repeated requests on a long-lived connection

Out-of-bounds read when parsing passkey authentication tokens that lack null terminators

Access control bypass for expired accounts with an LDAP shadow expiration value of zero

Query filter injection via unsanitized Entra ID search input discloses directory data

Memory exhaustion via a race between autofs map enumeration and invalidation

Use-after-free of stale GSSAPI connection state on reused PAM responder connections

Use-after-free in a deferred KCM callback during Kerberos ticket renewal

OData filter injection in Entra ID lookups exposes unintended directory objects

Out-of-bounds read from a miscalculated buffer offset in autofs responder request parsing

Heap-based buffer overflow via crafted fat32 filesystem image

Denial of service via heap buffer overflow during fat16 resize

Missing hostname verification for IP-address hosts in the mbedTLS TLS backend

Missing SSH host key verification in the libssh-based sftp protocol handler

Stack exhaustion in av_encryption_init_info_free() via thousands of MP4 pssh boxes

Infinite loop in the DASH demuxer via an empty SegmentTemplate media attribute

Uninitialized memory disclosure in av_dynamic_hdr_plus_to_t35() via HDR10+ metadata

Out-of-bounds read when emitting rpm-map artifacts

Missing decompressed-size limit when parsing compressed yaml

Unbounded recursion when parsing nested xmd yaml

Host file disclosure via file:// URIs in build manifest source downloads

Denial of service via repeated subroutine allocations in cid font loader

Cross-project authorization bypass in schedule and workflow-definition API endpoints

Denial of service via unbounded memory allocation during portmapper response decoding

Information disclosure via malformed format string

XSS via SanitizeDom Body and HTML Attributes

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Integer overflow on an oversized block index in crafted metadata leading to a crash

Heap buffer overflow in the RPC-over-RDMA server reply path for large NFS READ replies

Arbitrary code execution via macro expansion of entries in a crafted manifest file

Command injection in rpmuncompress via unescaped filenames passed to popen()

Command injection in rpmbuild via unescaped tarball path

Arbitrary code execution via Git hooks run when applying patch sources with use-git-am

Buffer overflow in strfmon and strfmon_l right-justification padding

EUC_JISX0213 decoding may hang on crafted input

SHIFT_JISX0213 decoding may hang on crafted input

Stack-based out-of-bounds write in tdelete during tree rebalancing

One-byte overread in strncasecmp on Power8

AT_SECURE program buffer overflow via $ORIGIN processing

Denial of service via unbounded connection thread spawning

Arbitrary file ownership change via symlink following in privileged paste

Local attacker can hijack file ownership via symlink race

Arbitrary file ownership and permission modification via symlink race condition

Crash in cockpit-ws on a request to the exact URL root without a trailing slash

Sensitive data exposure via command-line arguments

Sensitive data exposure of guest credentials via json argument in process list

Information disclosure of rhsm offline token via process arguments

Integer overflow in do_lastlog() offset calculation exposing lastlog records on ILP32

Excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

Memory exhaustion from unbounded GZIP decompression of AMQP messages

Out-of-bounds read and write after SSL_set_SSL_CTX() is called during a TLS handshake

Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Denial of service due to out-of-bounds read/write in remap engine

Out-of-bounds read in libXi's XI2 class parser

Out-of-bounds read in libXi's XListInputDevices() class parsing

Out-of-bounds read in libXi's XListInputDevices()

Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing

Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()

Out-of-bounds read in libXi's XQueryDeviceState()

Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion

OpenSSL pinning bypass

Certificate validation bypass when wolfSSL's cached CA store overrides the SSL_CTX callback

Connection reuse ignoring a changed CURLSSLOPT_NATIVE_CA setting

Cookie with Domain set to a public suffix saved with wildcard scope

Secure cookie attribute ignored when a tab precedes it in Set-Cookie

OpenSSL provider use-after-free

TLS certificate validation bypass in BalancedPool from dropped function-valued connect options

Caching and replay of responses to unsafe HTTP methods in the cache interceptor

Command injection in Bash completion via module names containing shell metacharacters

Missing Authorization via asset-history CSV importer

License key disclosure through CSV export and API index to users lacking the viewKeys permission

Disclosure of encrypted custom field values in asset forms to users without view permission

Authorization Bypass via Importer

Out-of-bounds read in libXtst's RECORD reply parser

Denial of service via use-after-free in binary heap erase_if

NULL pointer dereference in the kernel driver Fast I/O device control handler

Out-of-bounds read in the XIM attribute parser from a malicious X server

Out-of-bounds read in the XIM trigger-key registration parser from a malicious X server

Out-of-bounds read in libX11's byte-oriented codeset parser

Authorization bypass in question/create letting guests submit questions when disallowed

Stored XSS in FaqHelper::convertOldInternalLinks() via html_entity_decode() on FAQ content

Local denial of service via blocking ipc send operations

Denial of service due to null pointer dereference in pam responder

Fail-open in ldap ppolicy access check allows continued authorization

Denial of service in nss responder via crafted zero-length requests

Denial of service via malformed pam v1 requests

OOB read in nss service request parsers

Infinite loop in the TTL file parser leading to denial of service

Buffer Over-read in Wireshark

Denial of service via stack buffer overflow in scsi vpd page parsing

Denial of service via unsigned underflow in libXpm's write path

TOCTOU symlink race in g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION fallback

World-writable temporary child repositories in system-helper cache path

World-readable oci authentication token in system-helper cache path

Heap buffer overflow in librist_read() via RIST payloads larger than the caller buffer

Heap buffer overflow in the VC-2/Dirac RTP packetizer via an unbounded data unit size

Stack buffer overflow in the MPEG-PS muxer via an excessive number of streams

Heap buffer overflow in the hvcC box writer via too many NAL units of one type

Out-of-bounds read in the DASH demuxer via a decreasing live manifest startNumber

Out-of-bounds read in the AV1 RTP packetizer keyframe detection via a crafted OBU size

Out-of-bounds memory access in the AV1 RTP packetizer via a sign-flipped OBU size cast

Buffer overflow in ppp(8) mp_SetEnddisc() via an oversized PSN endpoint value

Out-of-bounds write in ppp(8) LcpDecodeConfig() via undersized endpoint discriminator options

Global buffer overflow in ppp(8) mp_Enddisc() via a received endpoint discriminator option

Buffer overflow in libalias RTSP handler

Authentication bypass in webauthn_login letting a logged-in user act as any account

TOTP code replay within the drift window due to untracked last accepted code

Authentication bypass in the jwt_refresh route issuing access tokens without a refresh token

CSRF protection bypass via content types containing an application/json substring

Open redirect via protocol-relative return-to paths in login and password confirmation flows

Authentication Bypass via LDAP

2FA Bypass via Remember-Me Cookie

Remote code execution via crafted mail headers

SSRF in modcss

Uncontrolled Resource Consumption in XmlTreeBuilder

Authorization bypass in CheckProfileTypeAuthorizer due to reversed profile type check

Authorization bypass via forged Keycloak access tokens with unverified signatures

Session termination via unsigned LogoutRequest in SAML2LogoutValidator.validateLogoutRequest()

Authentication bypass in the OIDC callback via substituted access tokens from other clients

Open redirect in DefaultLogoutLogic.perform() via backslash-prefixed logout targets

Heap buffer overflow in the C12.22 dissector causing a crash

NULL pointer dereference in the X.509IF dissector

Out-of-bounds Write in Wireshark

Stack buffer overflow in the C12.22 dissector causing a crash

Out-of-bounds write in BLF file parsing

Out-of-bounds Read in Wireshark

Out-of-bounds Read in Wireshark

NULL pointer dereference in the Bluetooth BR/EDR FHS dissector

Use After Free in Wireshark

Use of an uninitialized variable in the ESS dissector causing a crash

Out-of-bounds Read in Wireshark

NULL pointer dereference in the H.245 dissector

Out-of-bounds Write in Wireshark

NULL pointer dereference in the CMS dissector

Reachable Assertion in Wireshark

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Memory exhaustion in the i18n_messages endpoint via an arbitrarily large request body

Memory exhaustion in the migration endpoint via oversized unauthenticated POST bodies

NULL pointer dereference in the ipa-enrollment extended operation without a request value

CPU and memory exhaustion in otptoken-add via an oversized OTP key

Unbounded peer-controlled json parameters enables remote denial of service via resource exhaustion

Unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

Memory corruption from uncanceled AIO requests in the one-shot AIO error path

IV reuse across chunks in one-shot symmetric cipher operations on large inputs

Infinite wait loop in _kcapi_aio_read_all() when reusing an AIO handle after an error

CPU exhaustion in topic exchange routing via bindings with consecutive # wildcards

Inapplicable PUBLISH property disconnects matching subscribers

Descriptor prefix collision in the AMQP 1.0 parser lets stored messages crash consumers

Stored HTML injection in the management UI OAuth error handling leading to credential theft

OAuth credential refresh retains revoked runtime tags

Symlink-following chown allows local privilege escalation via pid file path manipulation

Dangling pointer to a stack buffer in dictionary string formatting corrupting document data

Out-of-bounds memory access in provider-manager IPC deserialization via malformed operation header

Privileged file corruption and denial of service via insecure temporary file handling

Integer underflow in iscsiuio ipv4 dhcp parsing

Integer underflow in iscsiuio dhcpv6 parsing

Denial of service in iscsiuio router advertisement parsing

Stack out-of-bounds read in s_vlog() when handling oversized log messages

SOCKS proxy localhost restriction bypass via IPv4-mapped IPv6 and unspecified addresses

Insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

Integer overflow in RPC attribute-array length calculation causing heap overwrite on 32-bit

Authorization bypass in the clonetasks mass action via an inverted project membership check

Local MITM of X11 forwarding via pre-bound abstract UNIX socket, in RHEL's OpenSSH client

Double free in the DH-GEX client during FIPS known-group validation, in RHEL's OpenSSH

Heap out-of-bounds read in GSSAPI indicator cleanup, in RHEL's OpenSSH

Use-after-free in HTTP/2 stream-dependency handling after curl_easy_reset()

Double free of the GSASL context during SASL authentication cleanup

Password for another .netrc user sent when the URL specifies only a username

Connection reuse ignores changed client certificate and private key TLS options

Known-host key type mismatch silently accepted via the CURLOPT_SSH_KEYFUNCTION callback

Use-after-free when curl_easy_pause() is called from the socket callback

Site-scoped capability check in nf_delete_all_data enables network-wide data deletion

Unauthenticated stored XSS via crafted Repeatable Fieldset submission indexes

Payment total tampering via fail-open get_calc_value() in ListSelect and ListRadio fields

Missing authorization in the submissions-table block exposes form submissions to visitors

Validation bypass via client-controlled field metadata in the AJAX submission handler

Out-of-bounds read and write in the ADX audio decoder via a mid-stream channel layout change

Double free in the NVDEC hardware decoder when no decoder surfaces remain

Stack buffer overflow in the Vulkan HEVC decoder via oversized vps_num_hrd_parameters

Heap buffer overflow in the VobSub subtitle demuxer via excessive distinct stream IDs

Infinite loop in rtp_asf_fix_header() via an undersized ASF chunksize

Out-of-bounds read in the S/PDIF muxer via an oversized DTS core_size value

Privilege escalation to administrator via unvalidated usergroup role assignments

Cross-tenant private SSH key disclosure via taxonomy scoping bypass

Authorization bypass lets host editors retarget lookup value overrides to other hosts

Cross-tenant infrastructure metadata disclosure via unvalidated IDs in taxonomy_scope

Missing Kerberos principal check in the gssapi-keyex path allows login as arbitrary users

Unbounded memory growth in SFTP clients from responses with unknown request IDs

Infinite loop in automatic certificate authentication leading to denial of service

Stack exhaustion via uncontrolled recursion when applying crafted JSON Patch documents

Exponential runtime in cJSON_Compare() on deeply nested JSON, leading to denial of service

Non-atomic JSON Patch application destroys target document members on failed operations

OAuth2 PKCE bypass via unpersisted S256 code_challenge_method during authorization

Argument injection in the APT backend via crafted package names leading to root code execution

Resource exhaustion in RHEL's system-mode RDP listener via unthrottled connections

Stack buffer overflow verifying EdDSA PGP signatures with mismatched MPI lengths

Stack buffer overflow in rpcinfo's rpcbdump() when formatting remote version lists

Stack buffer overflow in rpcinfo's rpcbaddrlist() via a malicious rpcbind server

Infinite loop and out-of-bounds read via a zero-length option in IPv6 Router Advertisements

Inverted IP SubjectAltName comparison in the OpenSSL backend skips authenticity checks

Permission check bypass in channelUpdate via all([]) lets anonymous users modify channels

Out-of-bounds read parsing FTP directory listings leaks memory from other transactions

Controller-side file disclosure via tampered Leapp report content during remediation

Insecure permissions on the PostgreSQL data backup archive expose data to local users

XSS via missing escaping in the generic image output layout

NULL pointer dereference in the SSH protocol dissector

Code injection via the mf command

Reachable assertion in HeifContext::get_track() when opening an empty HEIF sequence file

Use-after-free in mod_ldap with per-directory configuration

XSS in mod_proxy_ftp's FTP directory listing generation

Argument injection in the CONNECT engine's curl command line via the table HTTP attribute

Authorization bypass exposes stored routine definitions to role-granted EXECUTE users

Integer overflow in remote message decompression crashes the CIB remote listener

Integer overflow in SplashOutputDev::tilingPatternFill leading to heap buffer overflow

Stack buffer overflow in rrdcached via an oversized CREATE request

Stored XSS in the prescription multi-print view via patient demographic fields

Unbounded memory request in AcquireAlignedMemory leading to out-of-memory condition

Missing check in the DCM decoder allows images with invalid dimensions, causing crashes

NULL pointer dereference during OCSP chain checking with partial-chain verification

Double free in the TLS client when checking a crafted OCSP stapled response

Command injection via crafted DHCP options allows root code execution in the initramfs

Unauthenticated disclosure of the Active Directory default join password via adInfo()

SQL injection during profile field migration via user-supplied profile field data

Double free in parse_def() when parsing nested compound configuration blocks

Out-of-bounds read in sh_disassemble when disassembling crafted SH2A bytecode

Heap buffer overflow in set_reg_n when disassembling crafted SH2A FPU bytecode

SSO enforcement bypass via the API lets SSO users create local password credentials

Use-after-free in gnutls_pkcs11_token_set_pin() with a NULL old PIN