Red Hat Linux Security Advisories & Vulnerabilities
16067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Low [CVE-2025-3416] Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`
A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string. Red Hat severity: Low — CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-416. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat Trusted Artifact Signer; Red Hat Trusted Profile Analyzer. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: firefox; Red Hat package: gjs; Red Hat package: rpm-ostree; Red Hat package: openssl; and 7 more. Affected products named by the advisory: Red Hat package: mingw-openssl; Red Hat package: mozjs60; Red Hat package: python3.12-cryptography; Red Hat package: 389-ds-base; and 3 more.
Medium [CVE-2025-2251] Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H). Weakness: CWE-502. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7; Red Hat JBoss Enterprise Application Platform 8.0.8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9. Red Hat lists Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Red Hat fixing advisory: RHSA-2025:10931, RHSA-2025:10925, RHSA-2025:10926, RHSA-2025:10924, RHSA-2025:10459, RHSA-2025:10452, RHSA-2025:10453.
Medium [CVE-2025-3359] Gnuplot: segmentation fault via io_str_init_static_internal function
A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-754. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: gnuplot.
Low [CVE-2025-3360] Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601.
A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function. Red Hat severity: Low — CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: bootc; Red Hat package: glib2; Red Hat package: glycin-loaders; Red Hat package: loupe; and 2 more. Affected products named by the advisory: Red Hat package: mingw-glib2; Red Hat package: librsvg2.
High [CVE-2025-32049] Libsoup: denial of service attack to websocket server
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS). Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat fixing advisory: RHSA-2025:8128, RHSA-2025:21657, RHSA-2025:9179, RHSA-2025:8132, RHSA-2025:8480, RHSA-2025:8663, RHSA-2025:8482, RHSA-2025:8252, RHSA-2025:8126, RHSA-2025:8481, RHSA-2025:8140, RHSA-2025:8139. Affected products named by the advisory: Red Hat package: libsoup3.
High [CVE-2025-3155] Yelp: arbitrary file read
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. Red Hat has evaluated this with a Important severity as this requires user interaction and possibly access to add malicious JavaScript content, allowing the attacker to exfiltrate files from the victim's end with minimal user interaction. Weakness: CWE-601. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6.
High [CVE-2025-2784] Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. Red Hat rates this with a Moderate impact as the flaw may be targeting Confidentiality and Integrity specific to each request. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6. Affected products named by the advisory: Red Hat package: libsoup3.
Medium [CVE-2025-32053] Libsoup: heap buffer overflows in sniff_feed_or_html and skip_insignificant_space
A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read. A remote attacker who controls an HTTP server that a libsoup-based client connects to could send a crafted HTTP response that causes the client to read out of bounds, potentially resulting in a crash or exposure of out-of-bounds heap memory contents. Red Hat has rated this flaw Moderate severity with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), consistent with the upstream assessment. The libsoup package as shipped in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS is affected, and fixes are being pursued through the respective product maintenance streams. Red Hat Enterprise Linux 10, which ships the libsoup3 package, is not affected because the vulnerable code is not present in that version. Weakness: CWE-126. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Medium [CVE-2025-32052] Libsoup: heap buffer overflow in sniff_unknown
A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. A remote attacker who controls an HTTP server can send a crafted HTTP response to a client application using libsoup, causing the content sniffer to read beyond the bounds of a heap-allocated buffer when determining the content type. This out-of-bounds read can lead to disclosure of information from process memory or cause the client application to crash, consistent with the Red Hat severity rating of Moderate (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), which matches the upstream rating. Red Hat Enterprise Linux 8 and 9 (libsoup), Red Hat In-Vehicle OS (libsoup), and products shipping the mingw-libsoup variant are affected, and a fix is being pursued through the respective product streams. Red Hat Enterprise Linux 10 is not affected because the vulnerable code is not present in its libsoup3 packages. Weakness: CWE-126. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Medium [CVE-2025-32050] Libsoup: integer overflow in append_param_quoted
A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-127. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2025:4560, RHSA-2025:8292, RHSA-2025:4568, RHSA-2025:7436, RHSA-2025:4508, RHSA-2025:4440. Affected products named by the advisory: Red Hat package: libsoup; Red Hat package: mingw-freetype; Red Hat package: spice-client-win.
Medium [CVE-2025-2842] tempo operator token exposition lead to read sensitive data
A flaw was found in the Tempo Operator. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics. Red Hat has evaluated this vulnerability and rated with a Moderate impact as the attacker is limited to read access and requires previous permissions to read the token and get access to the cluster metrics. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-200. Affected Red Hat products: Red Hat OpenShift distributed tracing 3.5.3; Red Hat OpenShift distributed tracing 3. Red Hat fixing advisory: RHSA-2025:3607, RHSA-2025:3740.
Medium [CVE-2025-2786] serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks. Red Hat has evaluated this vulnerability and rated with a Moderate impact as the attacker is limited to read access and requires previous permissions to read the token and get access to the cluster metrics. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-200. Affected Red Hat products: Red Hat OpenShift distributed tracing 3.5.3; Red Hat OpenShift distributed tracing 3. Red Hat fixing advisory: RHSA-2025:3607, RHSA-2025:3740.
Medium [CVE-2025-2559] Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak
A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Build of Keycloak; Red Hat build of Keycloak 26.0; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2025:4336, RHSA-2025:4335.
Medium [CVE-2024-7631] Openshift-console: openshift console: path traversal
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of../ and valid directory paths. Due to the affected endpoint's logic, only files with the.json extension can be accessed, greatly limiting the impact of this vulnerability. No JSON files with a potential security impact could be identified on the console's pod. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift Container Platform 3.11; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2025-2487] 389-ds-base: null pointer dereference leads to denial of service
A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash. Red Hat rates this as a Moderate severity since the impact is limited to privileged users who can perform the operations, leading to an impact on server Availability. This issue is not reproducible in Red Hat Enterprise Linux (RHEL) 10 due to the way the RHEL 10 database write operations are serialized, therefore, it is not affected. 389-ds-base has been fixed in RHEL 9.5. Hence, it's actually not-affected and fix will be picked after rebase from RHEL-9.5. Weakness: CWE-476. Affected Red Hat products: Red Hat Directory Server 12.4 EUS for RHEL 9; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:3670, RHSA-2025:4491, RHSA-2025:7395, RHSA-2025:3663. Affected products named by the advisory: Red Hat package: 389-ds-base.
High [CVE-2025-2241] Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation. Hive is an operator which runs as a service for provisioning and perform initial configuration of OpenShift clusters. During this process users are creating instances of hive CRDs and other k8s objects, including a Secret containing credentials where Hive take these inputs and invokes openshift-install to create the spoke cluster. One of these objects is an instance of a hive CRD called ClusterProvision. The ClusterProvision object contains unintentionally sensitive information, which may be accessed by unauthorized actors. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-922. Affected Red Hat products: Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2024-8176] Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. All supported Red Hat offerings are built with the compilation flag (-fstack-clash-protection) which reduces the impact to Moderate. This build configuration blocks the possibility of an attacker gaining arbitrary code execution even if a stack-clash vulnerability, like this one, could be exploited. This vulnerability is rated Moderate because Red Hat builds use the `-fstack-clash-protection` compiler flag, which mitigates the risk of arbitrary code execution from stack overflows. While the flaw allows a crash via uncontrolled recursion in XML parsing, the hardened stack layout prevents reliable memory corruption, limiting the impact to a Denial of Service (DoS) scenario. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-674.
High [CVE-2025-2240] smallrye fault tolerance
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue. As this flaw can be triggered via the network, it has been rated with an important severity. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1325. Affected Red Hat products: Red Hat build of Apache Camel 4.8.5 for Spring Boot; Red Hat Build of Apache Camel 4.8 for Quarkus 3.15; Red Hat build of Quarkus 3.15.4; Red Hat build of Apicurio Registry 2; Red Hat Fuse 7; Red Hat Integration Camel K 1; Red Hat JBoss Enterprise Application Platform 7. Will not fix / out of support: Red Hat Fuse 7; Red Hat Integration Camel K 1; Red Hat JBoss Enterprise Application Platform 7. Red Hat fixing advisory: RHSA-2025:3543, RHSA-2025:3541, RHSA-2025:3376.
High [CVE-2025-23368] Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. According to WildFly Elytron, this affects all versions of JBoss EAP from version 7.1. Red Hat build of Keycloak does not ship wildfly-elytron. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-307. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 8.1.6.GA; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat Data Grid 8; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Process Automation 7; Red Hat Single Sign-On 7. Will not fix / out of support: Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Process Automation 7; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2026:33371, RHSA-2026:18059, RHSA-2026:18054, RHSA-2026:18055.
High [CVE-2025-0678] Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the direct_read() will perform a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections. Red Hat supported products are not affected by this vulnerability, as the grub2 versions shipped with it do not include the squash4 filesystem module. Red Hat severity: Moderate — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-190. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.