Red Hat Linux Security Advisories & CVEs
4725 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-16745] backend port 8080 trusts x-forwarded-access-token without origin validation
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure. Important: This flaw allows for privilege escalation within the cluster by bypassing authentication. It is due to the odh-dashboard backend binding to 0.0.0.0:8080 and trusting the x-forwarded-access-token header without origin validation. This enables any pod in the cluster to impersonate users by supplying an arbitrary token, circumventing the intended kube-rbac-proxy authentication. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-346. Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4. Red Hat fixing advisory: RHSA-2026:53261, RHSA-2026:65126, RHSA-2026:53263, RHSA-2026:53262, RHSA-2026:60520.
High [CVE-2026-19496] SQL injection (CWE-89) in query parameter filtering — unsanitised user input interpolated into WHERE clause
SQL injection (CWE-89) in query parameter filtering — unsanitised user input interpolated into WHERE clause. Red Hat rates this important (CVSS 8.8). Weakness: CWE-89.
High [CVE-2026-64835] Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count. A flaw was found in FFmpeg. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in arbitrary code execution, information disclosure, or denial of service. Conditions for Exploitation: Successful exploitation requires user interaction or a specific application workflow. An attacker cannot trigger this vulnerability entirely remotely on their own; they must supply a specially crafted ADX or AAX audio file and rely on a user or an automated media-processing system to actively parse it using the FFmpeg library. Affected products named by the advisory: Red Hat Enterprise Linux AI 3.0 for RHEL 9; Red Hat Enterprise Linux AI 3.2 for RHEL 9; Red Hat Enterprise Linux AI 3.3 for RHEL 9; Red Hat AI Inference Server 3.2; and 7 more.
High [CVE-2026-64834] Denial of Service via crafted RTP/ASF stream
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users. A flaw was found in FFmpeg. This vulnerability occurs because the rtp_asf_fix_header function does not properly validate the size of data chunks, preventing the processing loop from advancing. Successful exploitation leads to CPU exhaustion, causing a Denial of Service (DoS) for legitimate users. The impact rating reflects that this issue strictly impacts Availability (A:H) with low/no effect on Confidentiality or Integrity. Exploitation requires an active application to ingest and demux a maliciously crafted RTP/ASF media stream; passive files at rest pose no risk. Successful exploitation results in high CPU consumption that stalls the stream-processing thread or container worker, but it does not cause memory corruption or allow arbitrary code execution.
High [CVE-2026-64831] Arbitrary code execution via crafted HEVC/H.265 bitstream
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution. A flaw was found in FFmpeg. A remote attacker can exploit a stack buffer overflow vulnerability in the Vulkan HEVC (High Efficiency Video Coding) hardware decoder by providing a specially crafted HEVC/H.265 bitstream. This can lead to overwriting memory on the stack, potentially allowing the attacker to execute arbitrary code on the affected system. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-120. Red Hat lists Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI) as not affected.
High [CVE-2026-44191] Visual Studio Code Ansible Lightspeed extension: Remote Code Execution via command injection in configuration settings
A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise. This can occur when opening a malicious workspace or manually executing a playbook, leading to a complete compromise of the user's system. Note the VS Code extension is distributed via VS Code Marketplace, not shipped in AAP RPMs or containers. The vulnerable code does not exist in any AAP-shipped artifact. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78. Red Hat lists Red Hat Ansible Automation Platform 2 as not affected.
High [CVE-2026-44190] Ansible Lightspeed Visual Studio Code extension: Arbitrary code execution via command injection in activation script setting
A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the `ansible.python.activationScript` setting, intended for a virtual environment activation script, does not properly validate user input as a file path. If a user opens or executes a specially crafted project, an attacker could exploit this to gain complete control over the user's system with the privileges of the Visual Studio Code application. It enables arbitrary code execution on a user's system with VS Code process privileges if a malicious project's `.vscode/settings.json` is opened or a playbook executed without prior validation. This could lead to a complete system compromise. Note the VS Code extension is distributed via VS Code Marketplace, not shipped in AAP RPMs or containers. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78. Red Hat lists Red Hat Ansible Automation Platform 2 as not affected.
High [CVE-2026-44189] Visual Studio Code Ansible Lightspeed Extension: Arbitrary Code Execution via Malicious Playbook Filename
A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to the execution of arbitrary code with the privileges of the user running VS Code. This could result in a full system compromise, including the exfiltration of sensitive data, modification of project files, and permanent data loss. This could result in significant impact to confidentiality, integrity, and availability of user data and the system. Note the VS Code extension is distributed via VS Code Marketplace, not shipped in AAP RPMs or containers. The vulnerable code does not exist in any AAP-shipped artifact. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-88. Red Hat lists Red Hat Ansible Automation Platform 2 as not affected.
High [CVE-2026-40691] Denial of Service via crafted DNSCrypt query
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces. A flaw was found in Unbound, a domain name system (DNS) resolver. When Unbound is configured with DNSCrypt support, a remote attacker could send a specially crafted DNSCrypt query over TCP. This malicious query could cause a memory error, leading to a server crash and a Denial of Service (DoS). This means legitimate users would be unable to access services relying on the Unbound server. This is an Important denial of service vulnerability affecting Unbound when built with DNSCrypt support. This vulnerability doesn't impact any supported the versions of unbound as shipped with Red Hat Enterprise Linux as it is not compiled with DNSCrypt support.
High [CVE-2026-11331] Potential wildcard CNAME RPZ policy bypass
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. A flaw was found in BIND 9, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-20. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.18; Red Hat OpenShift Container Platform 4.22; Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:55437, RHSA-2026:54509, RHSA-2026:54510, RHSA-2026:55442, RHSA-2026:57189, RHSA-2026:55441, RHSA-2026:62549, RHSA-2026:65851, RHSA-2026:60440, RHSA-2026:54071.
High [CVE-2026-13321] DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. An attacker controlling any DNSSEC-signed zone can craft NSEC records that span into victim zones, enabling cross-zone cache poisoning with authenticated denial-of-service responses (AD=1). Red Hat severity: Important — CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). Weakness: CWE-345. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.18; Red Hat OpenShift Container Platform 4.22; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2026:55437, RHSA-2026:60383, RHSA-2026:54509, RHSA-2026:54654, RHSA-2026:54510, RHSA-2026:55442, RHSA-2026:57189, RHSA-2026:55441, RHSA-2026:62549, RHSA-2026:65851, RHSA-2026:57362, RHSA-2026:54071.
High [CVE-2026-11605] Unnecessary validation of DNSSEC signed records
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-400. Affected Red Hat products: Red Hat Hardened Images. Under investigation: Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:42853.
High [CVE-2026-11622] Potential memory usage beyond configured limits
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. This Important flaw in BIND's DNSSEC-validating resolver can lead to a denial of service. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-400. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat OpenShift Container Platform 4.22; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2026:55437, RHSA-2026:60383, RHSA-2026:54509, RHSA-2026:54654, RHSA-2026:54510, RHSA-2026:55442, RHSA-2026:57189, RHSA-2026:55441, RHSA-2026:57362, RHSA-2026:54071.
High [CVE-2026-11721] Cache poisoning via label count discrepancy, RRSIG, wildcards
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-345. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat OpenShift Container Platform 4.22; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2026:55437, RHSA-2026:60383, RHSA-2026:54509, RHSA-2026:54654, RHSA-2026:54510, RHSA-2026:55442, RHSA-2026:57189, RHSA-2026:55441, RHSA-2026:57362, RHSA-2026:66357, RHSA-2026:54071.
High [CVE-2026-12617] Record ordering based unexpected exit with CNAME or DNAME
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. This Important flaw in BIND can lead to a denial of service in Red Hat products. The `named` daemon may terminate unexpectedly when processing specific CNAME/DNAME and A record query orderings, coupled with precisely timed authoritative server responses. Exploitation requires an attacker to manipulate DNS responses from an authoritative server to a vulnerable resolver. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected. Red Hat fixing advisory: RHSA-2026:54071.
High [CVE-2026-13204] Unexpected exit with NSEC and NSEC3 both present
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat OpenShift Container Platform 4.22; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2026:55437, RHSA-2026:60383, RHSA-2026:54509, RHSA-2026:54654, RHSA-2026:54510, RHSA-2026:55442, RHSA-2026:57189, RHSA-2026:55441, RHSA-2026:57362, RHSA-2026:66357, RHSA-2026:54071. Affected products named by the advisory: Red Hat package: bind9.16; Red Hat package: bind9.18.
High [CVE-2026-32665] Denial of Service via improper validation of DNS-over-QUIC client length
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. An attacker could exploit improper validation of client-provided data length, leading to excessive memory allocation. This can cause the system to exceed its configured memory limits for QUIC connections, resulting in a Denial of Service (DoS) for new DoQ clients. This impacts the availability of the DNS resolver for DoQ connections.
High [CVE-2026-44690] Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. A flaw was found in Unbound. The primary impact is the integrity of DNS resolution, potentially leading to users being directed to malicious websites or services. This Important flaw in Unbound allows a remote attacker to perform DNS cache poisoning. By controlling a delegated zone, a malicious actor can manipulate DNS resolution for arbitrary sibling zones under NSEC-signed parent domains, potentially redirecting users to malicious destinations. This poses a significant integrity risk to systems relying on Unbound for DNS resolution.
High [CVE-2026-55973] Denial of Service via malformed EDNS Report-Channel option
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon. A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound daemon to terminate. This vulnerability results in a denial of service.
High [CVE-2025-50327] Privilege escalation and arbitrary code execution via Mark-of-the-Web bypass
Privilege escalation and arbitrary code execution via Mark-of-the-Web bypass. Red Hat rates this important (CVSS 8.8). Weakness: CWE-1289.