RHSA-2026:12274
Vulnerability from csaf_redhat - Published: 2026-05-08 20:57 - Updated: 2026-05-09 02:37Summary
Red Hat Security Advisory: OpenShift Container Platform 4.12.88 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.12.88 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container
Platform 4.12.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.12.88. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:12273
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
Security Fix(es):
None
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
7.5 (High)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
7.5 (High)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources.
A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.
6.1 (Medium)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.
A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.
6.6 (Medium)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.
7.0 (High)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the 'helpfile' option. A local user could exploit this by providing a specially crafted 'helpfile' option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.
7.3 (High)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.
4.4 (Medium)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.
5.3 (Medium)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in Vim. By including a newline character in a pattern passed to Vim's glob() function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user's shell settings.
7.3 (High)
Vendor Fix
For OpenShift Container Platform 4.12 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
You may download the oc tool and use it to inspect release image metadata
for x86_64 architecture. The image digest may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha value for the release is as follows:
(For x86_64 architecture)
The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd
All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
https://access.redhat.com/errata/RHSA-2026:12274
References
Acknowledgments
Elhanan Haenel
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.12.88 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container\nPlatform 4.12.\n\nRed Hat Product Security has rated this update as having a security impact\nof Low. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.12.88. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:12273\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nSecurity Fix(es):\n\nNone\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:12274",
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2428824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
},
{
"category": "external",
"summary": "2428825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
},
{
"category": "external",
"summary": "2437843",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437843"
},
{
"category": "external",
"summary": "2438542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
},
{
"category": "external",
"summary": "2443455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443455"
},
{
"category": "external",
"summary": "2443474",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443474"
},
{
"category": "external",
"summary": "2449006",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
},
{
"category": "external",
"summary": "2450907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450907"
},
{
"category": "external",
"summary": "2452945",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12274.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.12.88 bug fix and security update",
"tracking": {
"current_release_date": "2026-05-09T02:37:29+00:00",
"generator": {
"date": "2026-05-09T02:37:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.9"
}
},
"id": "RHSA-2026:12274",
"initial_release_date": "2026-05-08T20:57:44+00:00",
"revision_history": [
{
"date": "2026-05-08T20:57:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-08T20:57:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-09T02:37:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.12",
"product": {
"name": "Red Hat OpenShift Container Platform 4.12",
"product_id": "8Base-RHOSE-4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.12::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-412.86.202604281506-0",
"product": {
"name": "rhcos-x86_64-412.86.202604281506-0",
"product_id": "rhcos-x86_64-412.86.202604281506-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@412.86.202604281506?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-412.86.202604281506-0 as a component of Red Hat OpenShift Container Platform 4.12",
"product_id": "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
},
"product_reference": "rhcos-x86_64-412.86.202604281506-0",
"relates_to_product_reference": "8Base-RHOSE-4.12"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Elhanan Haenel"
]
}
],
"cve": "CVE-2026-4424",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-03-19T12:22:21.740000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449006"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: This heap out-of-bounds read vulnerability in libarchive\u0027s RAR archive processing logic can lead to information disclosure. A remote attacker can exploit this flaw by providing a specially crafted RAR archive, potentially revealing sensitive heap memory information without requiring authentication or user interaction on systems that process untrusted archives.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4424"
},
{
"category": "external",
"summary": "RHBZ#2449006",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4424"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2898",
"url": "https://github.com/libarchive/libarchive/pull/2898"
}
],
"release_date": "2026-03-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing"
},
{
"acknowledgments": [
{
"names": [
"Elhanan Haenel"
]
}
],
"cve": "CVE-2026-5121",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-03-30T07:40:25.358335+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452945"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: An integer overflow flaw in `libarchive` on 32-bit systems can lead to a heap buffer overflow. This vulnerability occurs when processing a specially crafted ISO9660 image, allowing an attacker to potentially execute arbitrary code. Red Hat Enterprise Linux 64-bit systems are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5121"
},
{
"category": "external",
"summary": "RHBZ#2452945",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc",
"url": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2934",
"url": "https://github.com/libarchive/libarchive/pull/2934"
}
],
"release_date": "2026-03-30T07:44:15.222000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing"
},
{
"cve": "CVE-2026-22695",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:52.403246+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "RHBZ#2428825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
"url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/issues/778",
"url": "https://github.com/pnggroup/libpng/issues/778"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
}
],
"release_date": "2026-01-12T22:55:40.204000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read"
},
{
"cve": "CVE-2026-22801",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:42.581146+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428824"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "RHBZ#2428824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
}
],
"release_date": "2026-01-12T22:57:58.288000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API"
},
{
"cve": "CVE-2026-25646",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-02-10T18:01:28.232408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438542"
}
],
"notes": [
{
"category": "description",
"text": "A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For `java-17-openjdk-headless` and `java-21-openjdk-headless`, while the affected code is present in the bundled sources, it is not exercised by these headless packages.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "RHBZ#2438542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/02/09/7",
"url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
"url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
}
],
"release_date": "2026-02-10T17:04:38.501000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize"
},
{
"cve": "CVE-2026-25749",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-02-09T11:08:59.061581+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437843"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the \u0027helpfile\u0027 option. A local user could exploit this by providing a specially crafted \u0027helpfile\u0027 option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via \u0027helpfile\u0027 option processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This MODERATE impact vulnerability in Vim\u0027s tag file resolution logic allows a local attacker to achieve a out-of-bounds write. By providing a specially crafted `helpfile` option value a local user can trigger a heap buffer overflow, as consequence lead to memory corruption presenting a data integrity impact or leading the vim process to crash resulting in availability impact. Although being non-trivial and very complex, arbitrary code execution is not discarded as worst case scenario.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25749"
},
{
"category": "external",
"summary": "RHBZ#2437843",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437843"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25749"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25749",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25749"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9",
"url": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.1.2132",
"url": "https://github.com/vim/vim/releases/tag/v9.1.2132"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43",
"url": "https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43"
}
],
"release_date": "2026-02-06T22:43:38.630000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Arbitrary code execution via \u0027helpfile\u0027 option processing"
},
{
"cve": "CVE-2026-28417",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-02-27T22:01:53.728412+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2443455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user\u0027s permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28417"
},
{
"category": "external",
"summary": "RHBZ#2443455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28417"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28417",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28417"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/79348dbbc09332130f4c860",
"url": "https://github.com/vim/vim/commit/79348dbbc09332130f4c860"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0073",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0073"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336",
"url": "https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336"
}
],
"release_date": "2026-02-27T21:54:35.196000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin"
},
{
"cve": "CVE-2026-28421",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-02-27T23:01:44.673504+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2443474"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Denial of service and information disclosure via crafted swap file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user\u0027s permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28421"
},
{
"category": "external",
"summary": "RHBZ#2443474",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443474"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28421"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/65c1a143c331c886dc28",
"url": "https://github.com/vim/vim/commit/65c1a143c331c886dc28"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0077",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0077"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p",
"url": "https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p"
}
],
"release_date": "2026-02-27T22:06:34.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Denial of service and information disclosure via crafted swap file"
},
{
"cve": "CVE-2026-33412",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-03-24T20:02:21.511965+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450907"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim. By including a newline character in a pattern passed to Vim\u0027s glob() function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user\u0027s shell settings.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via command injection in glob() function",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33412"
},
{
"category": "external",
"summary": "RHBZ#2450907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450907"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33412"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33412",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33412"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a",
"url": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0202",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0202"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c",
"url": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c"
}
],
"release_date": "2026-03-24T19:43:07.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-08T20:57:44+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3e68f1c5d392780d1e848c2b98dbfd9965b3dfc85b4279ca894003c6495420fd\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:12274"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202604281506-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via command injection in glob() function"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…