Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding

An out-of-bounds write vulnerability in Vim's spellsoundfoldsal function allows an attacker to corrupt memory and crash the editor Denial of Service by supplying a specially crafted word during spell sound-folding...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-42806

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI C-driver in version v1.0.3 and prior, specifically within the field data parsing logic in readallfielddata bme69x.c. The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer setval...

CVE-2026-42806

An out-of-bounds read vulnerability exists in the Bosch BME690 SensorAPI C-driver (v1.0.3 and prior) within the read_all_field_data function (bme69x.c). The driver prefetches heater configuration registers into a 30-byte stack buffer, but the gas_index field is extracted with a 4-bit mask (0–15) ...

EUVD-2026-75362

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI C-driver in version v1.0.3 and prior, specifically within the field data parsing logic in readallfielddata bme69x.c. The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer setval...

CVE-2026-42806

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI C-driver in version v1.0.3 and prior, specifically within the field data parsing logic in readallfielddata bme69x.c. The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer setval...

CVE-2026-59984

A flaw was found in OpenEXR. When processing a specially crafted B44-compressed EXR image, an out-of-bounds write can occur due to an integer truncation vulnerability in ILP32 builds. This allows an attacker to cause a denial of service or potentially lead to memory corruption. Mitigation Red Hat...

EUVD-2026-75300

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-61908

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by attempting to download a specially crafted JMAP JSON Meta Application Protocol blob ID. This action could lead to reading beyond the intended memory boundary, potentially exposing sensitive information from...

vim: Vim: Denial of Service via crafted spell file

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted spell file. This malicious file can trigger a stack out-of-bounds write, which corrupts the editor's memory and causes it to crash...

vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator

A flaw was found in Vim. A remote attacker could exploit a heap-based buffer overflow and an out-of-bounds read vulnerability in Vim's terminal emulator. This occurs when processing specially crafted Unicode supplementary plane characters, potentially leading to information disclosure and denial ...

vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding

An out-of-bounds write vulnerability in Vim's spellsoundfoldsal function allows an attacker to corrupt memory and crash the editor Denial of Service by supplying a specially crafted word during spell sound-folding...

vim: Vim: Denial of Service via out-of-bounds write in terminal handling

A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service...

CVE-2026-79516

A flaw was found in nothings stb. An out-of-bounds read vulnerability exists in the stbspvsnprintf function. A local attacker could exploit this by sending a specially crafted input. This could lead to a Denial of Service DoS, making the affected system unavailable. Mitigation Mitigation for this...

CVE-2026-79515

A flaw was found in the stb component. An out-of-bounds read vulnerability in the stbttGetGlyphShape function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted TrueType Font TTF file. This can lead to the affected application becoming unresponsive or crashin...

kernel: sctp: diag: reject stale associations in dump_one path

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostics. When performing a socket diagnostic sockdiag lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...