2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 21 of 41

• CVE-2026-46239MEDIUM 5.5

  A memory management bug in the Linux kernel's OV5647 camera driver causes system resources to not be properly released when certain camera control operations are performed. Specifically, three control settings—autogain, automatic exposure, and analog gain—skip the cleanup step that tells the system a resource is no longer needed, leaving the system in a degraded state. Repeated use of these controls can exhaust system resources and cause the kernel to become unstable or unresponsive.

• CVE-2026-46245MEDIUM 5.5

  A flaw in the Linux kernel's AMD display driver (amdgpu) can cause a system crash when the driver attempts to initialize Hot Plug Detect (HPD) interrupts for video connectors. The problem occurs because the code checks whether a connector's data structure (dc_link) is valid in one place, but then later uses it without checking again, leading to a null pointer dereference. This vulnerability affects systems with AMD GPUs running vulnerable kernel versions and can be triggered by a local user, resulting in a denial of service.

• CVE-2026-46247MEDIUM 5.5

  This vulnerability affects the Linux kernel's clock management subsystem, specifically the graphics processor (GFX3D) clock driver. A bug in how parent clock information is passed during rate calculations causes the system to crash when the GPU attempts to change its operating frequency. The issue emerged after a code refactoring that changed how clock dividers calculate rates. When the GPU's power management system tries to adjust clock speed—a routine operation during dynamic frequency scaling—the missing parent clock information causes a kernel panic. The vulnerability requires local access and affects systems running vulnerable kernel versions on Qualcomm-based devices.

• CVE-2026-46248MEDIUM 5.5

  This vulnerability affects the Linux kernel's WiFi driver for Qualcomm Atheros ath12k chipsets. When a WiFi interface fails during setup for multi-link operation (MLO), the driver can retain stale data about link mappings. If a new connection attempt reuses the same link ID, the driver triggers a warning and may experience instability. The issue stems from incomplete cleanup during failed initialization—specifically, link deletion code only runs if the interface was fully created, leaving orphaned references behind.

• CVE-2026-46249MEDIUM 5.5

  This Linux kernel vulnerability affects the OcteonTX2 ARM-based System-on-Chip (SoC) driver stack, specifically the Application Firmware (AF) and Physical Function (PF) drivers used in Marvell networking hardware. During a kexec reboot—a fast reboot mechanism that skips the firmware/BIOS phase—hardware state from the previous kernel persists. The bug occurs when AF fails to properly clear its initialization marker before shutdown. When the PF driver loads in the new kernel, it checks this marker to determine if AF is ready. Finding a stale marker, the PF driver incorrectly assumes AF has already initialized and attempts to access hardware that was never properly reset, causing a kernel crash. This is primarily a denial-of-service condition affecting systems performing kexec reboots with modular driver configurations.

• CVE-2026-46252MEDIUM 5.5

  A locking bug exists in the Linux kernel's regulator power management subsystem. When the system attempts to enable a power supply regulator and that operation fails, the error-handling code releases a reference to the regulator object without holding the required lock. This creates a race condition where another part of the system could be accessing the regulator data simultaneously, potentially causing a crash or memory corruption. The fix involves using the correct function call that ensures proper locking during cleanup, and adding additional safeguards to prevent concurrent access while clearing internal pointers.

• CVE-2026-46254MEDIUM 5.5

  A vulnerability in the Linux kernel's AppArmor security module can cause system crashes or hangs when AppArmor processes policy rules containing improperly aligned data structures. The kernel's DFA (Deterministic Finite Automaton) tables used by AppArmor to enforce security policies may originate from either kernel memory or user-supplied configuration, and when these tables aren't properly aligned to 8-byte boundaries, certain CPU architectures trigger unaligned memory access errors. This is a denial-of-service issue—an unprivileged user with the ability to load or modify AppArmor policies could crash the kernel without data loss or privilege escalation.

• CVE-2026-46255MEDIUM 5.5

  The Linux kernel's fsl-edma driver contains a resource management bug where clock handles are being manually disabled during driver removal, even though they were allocated using automatic cleanup functions. This causes the system to attempt disabling clocks that have already been cleaned up by the kernel, generating warnings and potentially destabilizing the driver removal process. The fix is straightforward: remove the redundant manual disable calls and let the automatic cleanup mechanism handle it.

• CVE-2026-46256MEDIUM 5.5

  A recursion deadlock vulnerability exists in the Linux kernel's NFS LOCALIO feature, which optimizes loopback NFS mounts by bypassing the network when client and server run on the same system. Under memory pressure, the kernel's direct reclaim mechanism can trigger a circular chain: NFS writes → XFS filesystem → back into NFS page cache operations, causing the system to hang. The vulnerability requires local access and affects systems using LOCALIO-enabled NFS mounts. A fix ensures memory allocations in the LOCALIO code path use GFP_NOFS context to prevent this recursion.

• CVE-2026-46257MEDIUM 5.5

  A flaw in the Linux kernel's SP804 timer driver can cause the system to crash when certain timing functions are called on ARM32 platforms. The issue arises when the SP804 timer is configured in a way that leaves a shared clock object uninitialized, but the kernel still tries to read from it. This vulnerability has been fixed by separating the delay timer functionality into its own dedicated clock instance, preventing the kernel from attempting to access uninitialized memory.

• CVE-2026-46258MEDIUM 5.5

  A flaw in the Linux kernel's GPIO character device (cdev) interface causes the system to crash when creating a line handle. The issue occurs because code attempts to use a pointer after it has been intentionally cleared to NULL, leading to a crash when the kernel tries to access memory through that invalid pointer. This is a local issue—an authenticated user on the system would need to trigger it, typically through ioctl calls to the GPIO device.

• CVE-2026-46261MEDIUM 5.5

  A vulnerability in the Linux kernel's SPI WPC flash interface unit driver can cause the system to crash due to a missing safety check. When the driver initializes, it attempts to access memory resources without first verifying they exist, potentially leading to a NULL pointer dereference that brings down the affected process or system. This is a localized denial-of-service issue requiring local system access to trigger.

• CVE-2026-46262MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's audio subsystem (ASoC fsl_xcvr driver) where a recent locking fix introduced the opposite problem: the code attempts to re-acquire a lock that is already held by the calling function, causing the system to hang. When a user adjusts audio control settings through ALSA, the kernel deadlocks instead of safely updating the configuration.

• CVE-2026-46268MEDIUM 5.5

  A logic error in the Linux kernel's PCI peer-to-peer DMA memory allocation code causes a spurious warning to be logged when kernel debug features are enabled. The vulnerability stems from a mismatch between a code assertion and a prior change to how memory pages are initialized—the assertion expects a non-zero reference count, but the pages are now created with a zero count by design. While the actual functionality remains intact, the warning floods kernel logs and can trigger monitoring alerts, degrading system observability and potentially masking other issues.

• CVE-2026-46269MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's Canaan K230 pinctrl driver. During device initialization, the driver attempts to access a device structure through an uninitialized pointer, causing the kernel to crash. The issue occurs because the code tries to retrieve the device reference via a control structure that hasn't been set up yet. An attacker with local access could trigger this crash by loading the affected driver or probing the device, leading to a denial of service.

• CVE-2026-46276MEDIUM 5.5

  A Linux kernel bug in AMD's GPU driver causes the system to crash during startup when loading newer AMD Radeon RX 9070 XT graphics cards on RDNA4 hardware. The issue stems from the driver trying to initialize memory regions that don't physically exist on this newer GPU architecture. When the kernel attempts to set up these non-existent resources with zero size, it triggers a safety check that crashes the boot process. This only affects systems where kernel debugging is enabled; most deployments have avoided the crash by accident rather than design.

• CVE-2026-46278MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's Imagination PowerVR graphics driver. When a local user attempts to update ftrace debug settings through a debugfs interface, the driver passes incorrect data to the operation, causing the kernel to crash. This is a stability issue rather than a data breach or privilege escalation risk—an authenticated local user can trigger a denial of service condition.

• CVE-2026-46282MEDIUM 5.5

  A flaw in the Linux kernel's admv1013 frequency driver can cause the system to crash or become unresponsive. The vulnerability occurs when the driver fails to properly read a configuration setting from the device, but then tries to use that uninitialized data anyway, leading to a null pointer dereference. An unprivileged local user with access to the affected system could trigger this condition to cause a denial of service.

• CVE-2026-46283MEDIUM 5.5

  A vulnerability in the Linux kernel's TPM (Trusted Platform Module) driver leaves sensitive cryptographic session keys in freed memory when a TPM device is closed. The driver should zero out this memory before releasing it—a standard security practice it already uses in other code paths—but this particular cleanup path was missed. An attacker with local access could potentially recover these keys from freed memory before it's overwritten by other processes.

• CVE-2026-46284MEDIUM 5.5

  A defect in the Linux kernel's hugepages parameter parsing can cause the system to crash during early boot if certain kernel command-line parameters are malformed. Specifically, if hugepages, hugepagesz, or default_hugepagesz parameters are supplied without an equals sign (e.g., 'hugepages 1G' instead of 'hugepages=1G'), the kernel's early parameter handler passes a NULL pointer to the hugetlb_add_param() function, which then crashes when attempting to measure the string length. The fix validates input before processing and rejects malformed parameters gracefully.

• CVE-2026-46286MEDIUM 5.5

  A vulnerability exists in the Linux kernel's Qualcomm LED driver (qcom-lpg) where a register value intended to select from a predefined array is not properly validated before use. The register can hold values 0–7 (from a 3-bit field), but the array contains only 5 entries. Without bounds checking, out-of-range values cause the code to read uninitialized or incorrect memory, which then gets used to configure LED brightness timing parameters. While actual hardware typically produces valid register values, the lack of defensive checks creates a potential denial-of-service condition if invalid data is encountered.

• CVE-2026-46287MEDIUM 5.5

  The Linux kernel's txgbe network driver has a defect in how it disconnects from external PHY (Physical Layer transceiver) devices when the driver module is unloaded. When users remove the txgbe module, the driver attempts to disconnect the PHY without first acquiring the RTNL (Real-Time Netlink) lock, which is required by the kernel's phylink subsystem. This causes a kernel assertion failure and warning message, though it does not directly compromise system security or data. The fix involves wrapping the disconnect call with proper locking.

• CVE-2026-46290MEDIUM 5.5

  A Linux kernel bug affects how the system handles page faults during firmware calls on x86/EFI systems. Recent changes to improve cryptographic performance modified how the kernel manages floating-point unit access, inadvertently causing the page fault handler to always bail out when firmware triggers a fault. On systems with buggy firmware that generates page faults during runtime calls, this escalates to a system panic and hard freeze instead of gracefully recovering. The fix changes the fault detection logic to properly distinguish between real interrupt contexts and the FPU management code path.

• CVE-2026-46291MEDIUM 5.5

  A flaw in the Linux kernel's cryptographic subsystem can expose sensitive HMAC key material through debug output when certain debugging configurations are enabled. The vulnerability exists in the hash_digest_key function of the CAAM (Cryptographic Acceleration and Assurance Module) driver, which was inadvertently dumping key bytes in plaintext during kernel logging. An attacker with local access could potentially read these keys from kernel logs or memory if dynamic debugging is active, compromising cryptographic operations that depend on key secrecy.

• CVE-2026-46292MEDIUM 5.5

  A Linux kernel vulnerability in the power domain management (genpd) subsystem leaves virtual devices with runtime PM incorrectly enabled after detachment. When drivers use genpd_dev_pm_attach_by_id() to register virtual devices, the kernel enables runtime PM for them but fails to disable it when those devices detach. This leaves the system in an inconsistent state that can trigger NULL pointer dereferences or cause the kernel to unnecessarily vote for higher performance states. The fix adds a missing pm_runtime_disable() call during device detachment to restore proper state management.

• CVE-2026-46295MEDIUM 5.5

  A race condition in the Linux kernel's KVM hypervisor can cause the system to incorrectly report whether virtual CPUs have pending interrupts. When one virtual CPU sends an interrupt to another while the receiving CPU is simultaneously checking for pending interrupts, a timing gap allows the system to think an interrupt has arrived when it hasn't actually been delivered yet. While the interrupt itself isn't lost—it remains queued internally—the false reporting triggers a warning message and wastes CPU cycles with unnecessary virtual machine context switches. This affects systems running KVM hypervisor on x86 processors, particularly in nested virtualization scenarios under heavy load.

• CVE-2026-46296MEDIUM 5.5

  A bug in the Linux kernel's SPI driver for Samsung S3C64xx controllers can crash the system when the driver is unloaded. The issue stems from incomplete refactoring: code that allocates DMA channels was moved from initialization to a later setup phase, but the corresponding cleanup code was not removed from the driver shutdown process. When the driver unloads, it tries to release DMA resources that were never allocated, triggering a NULL-pointer crash.

• CVE-2026-46297MEDIUM 5.5

  A vulnerability in the Linux kernel's libwx networking driver incorrectly uses a threaded interrupt handler setup with missing threaded handler logic, triggering kernel warnings and potential system instability. The issue affects virtual function (VF) miscellaneous interrupt handling. The fix involves switching to the standard non-threaded interrupt request function and removing an unnecessary flag that doesn't apply to non-threaded handlers.

• CVE-2026-46302MEDIUM 5.5

  A Linux kernel vulnerability allows a single process to monopolize read access to the SELinux security policy file, preventing other processes from retrieving critical security configuration. This denial-of-service condition stems from an overly restrictive locking mechanism that was originally intended to prevent memory exhaustion and inconsistent policy views, but achieves neither goal effectively. The issue is resolved by allowing concurrent reads of the policy file while maintaining data integrity through refined locking.

• CVE-2026-46305MEDIUM 5.5

  A flaw in the Linux kernel's rtl8723bs WiFi driver can cause the system to crash if memory allocation fails during buffer initialization. When the driver attempts to create a buffer, it doesn't properly check whether the memory allocation succeeded before trying to use it. If the allocation fails—a condition that may occur under memory pressure—the code will attempt to access a NULL pointer, causing a denial of service. This is a localized driver issue affecting WiFi functionality rather than a system-wide kernel compromise.

• CVE-2026-46310MEDIUM 5.5

  A flaw in the Linux kernel's Renesas VSP1 media driver causes a system crash when the module is unloaded on certain hardware generations. The bug stems from cleanup code calling the wrong function variant, leaving a dangling pointer that triggers a crash. This affects local users with module unload privileges and requires a kernel patch to resolve.

• CVE-2026-46312MEDIUM 5.5

  A flaw in the Linux kernel's video buffer management can trigger a kernel warning when memory-mapped video buffers from certain capture drivers are accessed through the graphics subsystem. While the warning itself doesn't cause data loss or direct compromise, it indicates improperly configured memory protections that should have been set. This affects primarily developers and systems running specialized camera capture software on affected kernels.

• CVE-2026-46313MEDIUM 5.5

  A flaw exists in the Linux kernel's Intel IPU6 media driver where an error-handling code path incorrectly dereferences a pointer that has been marked as invalid (an error pointer). When the driver encounters certain initialization failures during PCI device probing, it attempts to clean up resources but doesn't properly null-check a pointer before using it, leading to a kernel crash. This is a local denial-of-service issue affecting systems running vulnerable kernel versions with the Intel IPU6 driver enabled.

• CVE-2026-46314MEDIUM 5.5

  A flaw in the Linux kernel's DRM v3d driver allows a local user to trigger an infinite loop by submitting a maliciously crafted system call with a self-referential extension structure containing zero synchronization counts. This causes the kernel to hang indefinitely, consuming CPU resources and freezing the affected process. An attacker with local access can exploit this to perform a denial-of-service attack on systems running vulnerable kernel versions.

• CVE-2026-46315MEDIUM 5.5

  A vulnerability in the Linux kernel's io_uring subsystem can leak uninitialized kernel memory to userspace when using the IOURING_OP_WAITID operation. When a wait operation completes without reporting child process events, the kernel fails to zero-initialize its result buffer before copying it to user applications, exposing stale data that was previously stored in the same kernel memory. This is a local information disclosure issue affecting users who can invoke io_uring operations on systems where they have access.

• CVE-2026-46318MEDIUM 5.5

  A vulnerability in the Linux kernel's hugetlbfs memory management subsystem can cause a memory leak when virtual memory area (VMA) lock allocation fails during the memory mapping preparation stage. The issue stems from an earlier patch that attempted to optimize how hugetlb mappings are set up, but inadvertently created a window where a failed lock allocation could leave resources unreleased. A local user with standard privileges can trigger this condition, leading to denial of service through memory exhaustion.

• CVE-2026-46329MEDIUM 5.5

  A flaw in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation fails to properly handle I/O requests that extend beyond the filesystem boundary when the filesystem is mounted from a file. Instead of safely zeroing out the requested data (as loopback devices and the kernel's expected behavior dictate), the kernel may access invalid memory or return uninitialized data. This can lead to a denial of service or potential information disclosure on systems using file-backed EROFS mounts.

• CVE-2026-46465MEDIUM 5.5

  Dell PowerProtect Data Domain contains a format string vulnerability that allows a high-privileged attacker with network access to trigger information disclosure or crash the system. While the vulnerability requires elevated privileges to exploit, its presence in backup and archival infrastructure—often a critical dependency—warrants careful monitoring and timely patching.

• CVE-2026-46521MEDIUM 5.5

  ImageMagick, a widely-used open-source image manipulation library, contains a flaw in its LZMA compression handling within the MIFF encoder. When processing specially crafted image files, the software can write data beyond allocated memory boundaries, potentially crashing the application or corrupting system memory. This vulnerability affects versions prior to 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch).

• CVE-2026-47262MEDIUM 5.5

  containerd, the widely-used container runtime that powers Docker and Kubernetes, has a memory exhaustion vulnerability that can crash the entire runtime. A specially crafted container image can trigger the vulnerability when the container is created, causing memory to be consumed until the containerd process runs out of memory and is killed by the operating system. This knocks the container runtime offline, breaking both container orchestration and any applications depending on it. The flaw affects containerd versions before 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2.

• CVE-2026-47326MEDIUM 5.5

  Ubuntu Linux versions 6.8, 6.17, and 7.0 contain a memory leak flaw in how the kernel handles large responses from AppArmor (the mandatory access control framework). An unprivileged local user can trigger this leak repeatedly, causing the system to exhaust available memory and potentially become unstable or unresponsive. The vulnerability requires local access and does not compromise data confidentiality or integrity, but can degrade or deny service to legitimate users.

• CVE-2026-47332MEDIUM 5.5

  Ubuntu Linux versions 6.8, 6.17, and 7.0 contain a flaw in their AppArmor security module patches that allows unprivileged local users to read sensitive data from kernel memory. The vulnerability stems from incorrect validation of an internal data structure size during notification processing. An attacker with local user privileges can exploit this to leak information from adjacent memory regions (kernel slab objects), potentially exposing cryptographic keys, session tokens, or other sensitive kernel data.

• CVE-2026-47334MEDIUM 5.5

  Ubuntu Linux kernels 6.8, 6.17, and 7.0 contain a bug in AppArmor notification handling code that can be triggered by any unprivileged local user to crash the kernel or cause it to hang. The issue stems from code that incorrectly sleeps while holding a spinlock—a low-level synchronization primitive—creating a condition where the system becomes unresponsive or fails entirely. An attacker with basic local access can reliably exploit this without special privileges or user interaction.

• CVE-2026-47335MEDIUM 5.5

  Ubuntu Linux kernel version 6.8 contains a defect in how it handles AppArmor security notifications. An unprivileged local user can trigger a NULL pointer dereference—a programming error where the kernel tries to access memory that doesn't exist—causing the entire system to crash. This is a local denial-of-service vulnerability; it does not allow data theft or privilege escalation, but it can disrupt service availability.

• CVE-2026-47748MEDIUM 5.5

  A flaw in stable-diffusion.cpp allows attackers to crash applications or potentially read sensitive memory by providing a malformed or intentionally truncated model checkpoint (.ckpt) file. The vulnerability exists in how the library parses PyTorch checkpoint files—it fails to validate that sufficient data remains before reading, so a crafted file can cause the parser to read past the end of its buffer. An attacker would need to trick a user or application into loading a malicious .ckpt file, typically from an untrusted model repository. The practical risk is limited to environments that load external model files, but the impact on those systems can be significant.

• CVE-2026-47770MEDIUM 5.5

  jq, a widely-used command-line tool for processing and querying JSON data, contains a denial-of-service vulnerability in versions before 1.8.2. When comparing two deeply nested JSON arrays using the == operator, jq crashes due to stack exhaustion. An attacker can trigger this crash by supplying specially crafted nested JSON structures, either directly via command-line input or through embedded jq usage in applications. The crash leaves no data corruption or security breach—just service unavailability. This is a local or user-interaction vulnerability, not remotely exploitable on its own, but it can disrupt any workflow or service relying on jq to process untrusted JSON.

• CVE-2026-47923MEDIUM 5.5

  Adobe Acrobat Reader contains a flaw that allows an attacker to read sensitive data from a user's computer memory by tricking them into opening a specially crafted file. The vulnerability doesn't damage files or prevent the application from running, but it could expose confidential information like passwords, encryption keys, or personal data that happens to be in memory at the time of exploitation. Versions 24.001.30365, 26.001.21651 and earlier on Windows and macOS are affected.

• CVE-2026-47924MEDIUM 5.5

  Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a use-after-free memory flaw that could allow an attacker to read sensitive data from the application's memory. The vulnerability requires a user to open a crafted malicious PDF or document file, making this a low-friction attack that relies on social engineering rather than complex exploitation techniques. While memory disclosure alone does not enable direct system compromise, the leaked information could include credentials, encryption keys, or other confidential content.

• CVE-2026-47925MEDIUM 5.5

  Adobe Acrobat Reader contains an integer overflow flaw that crashes the application when a user opens a specially crafted file. While this is a denial-of-service issue rather than a data breach or code execution vulnerability, it can disrupt business workflows. The flaw affects Acrobat Reader DC versions 24.001.30365, 26.001.21651 and earlier across Windows and macOS. An attacker must trick a user into opening a malicious PDF or document to trigger the crash.

• CVE-2026-47926MEDIUM 5.5

  Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a memory reading flaw that allows attackers to extract sensitive information from your system. The vulnerability requires a user to open a specially crafted malicious file, making social engineering a necessary component of any attack. While the flaw cannot be used to modify files or crash the application, the potential for exposing confidential data—such as encryption keys, credentials, or personal information resident in memory—presents a meaningful risk to organizations handling sensitive documents.

• CVE-2026-47927MEDIUM 5.5

  Adobe's DNG SDK, a toolkit for processing Digital Negative image files, contains a flaw that allows an attacker to read sensitive data from a victim's computer memory. When a user opens a specially crafted malicious DNG image file, the SDK attempts to read data from memory regions it shouldn't access, potentially exposing passwords, encryption keys, or other confidential information. An attacker must trick a user into opening the malicious file—the vulnerability cannot be exploited remotely or automatically.

• CVE-2026-47934MEDIUM 5.5

  Adobe's DNG SDK, a widely-used library for processing Digital Negative image files, contains a memory reading flaw that could expose sensitive data. When a user opens a specially crafted DNG image file, the SDK reads memory it shouldn't access, potentially leaking information like encryption keys, passwords, or other confidential data stored in application memory. The vulnerability requires user interaction—an attacker must trick someone into opening a malicious file—which limits its reach but doesn't eliminate the risk for targeted scenarios.

• CVE-2026-47961MEDIUM 5.5

  Adobe Acrobat Reader contains an out-of-bounds read flaw that allows attackers to extract sensitive data from system memory. The vulnerability requires user interaction—specifically, opening a malicious PDF or document file. When triggered, the flaw exposes unintended memory contents that could include confidential information resident in the application's process space.

• CVE-2026-47963MEDIUM 5.5

  Adobe's DNG SDK—a tool developers use to handle DNG (Digital Negative) image files—contains a flaw that lets attackers read private information from a computer's memory. The vulnerability exists in DNG SDK version 1.7.1 build 2536 and earlier. An attacker would need to trick a user into opening a specially crafted malicious file to trigger the leak. While the memory exposure is significant, the attack requires user action, which limits its immediate reach.

• CVE-2026-48155MEDIUM 5.5

  pypdf, a popular open-source PDF processing library, contains a denial-of-service vulnerability affecting versions prior to 6.12.0. An attacker can craft a malicious PDF file that, when processed by pypdf's text extraction feature in layout mode, triggers excessive memory consumption. This occurs specifically when the PDF contains large character offsets. The flaw does not compromise data confidentiality or integrity, but can render systems unresponsive or crash applications that depend on pypdf for PDF handling.

• CVE-2026-48267MEDIUM 5.5

  Adobe DNG SDK versions 1.7.1 (build 2536) and earlier contain a flaw that can crash applications using the library when a user opens a specially crafted file. An attacker would need to trick a user into opening a malicious file—there's no remote exploitation vector. The result is a denial-of-service condition; the attacker cannot steal data or gain code execution.

• CVE-2026-48493MEDIUM 5.5

  Snipe-IT is an asset management platform used by IT teams to track hardware, software licenses, and inventory. A flaw in versions before 8.6.0 allows a basic user who can only edit their own profile to escalate their own privileges. By sending a specially crafted request to their account settings, they can grant themselves broader permissions—such as the ability to view or create assets, access reports, or perform imports—without needing administrator approval. While admin and superuser roles remain protected, this self-service privilege escalation undermines access controls and could let a low-privilege insider gain visibility into sensitive IT operations data or make unauthorized asset changes.

• CVE-2026-48566MEDIUM 5.5

  CVE-2026-48566 is a memory-reading flaw in Windows Desktop Window Manager (DWM) Core Library that allows a logged-in user to read sensitive information from memory that they should not have access to. An attacker with a local user account can exploit this to leak confidential data—such as encryption keys, authentication tokens, or other protected information—without crashing the system or modifying files. The vulnerability requires the attacker to already have an account on the machine; it cannot be exploited remotely.

• CVE-2026-48724MEDIUM 5.5

  ImageMagick versions before 7.1.2-24 contain a memory corruption flaw triggered when processing images that use a mask combined with the Floyd-Steinberg dithering algorithm. The vulnerability allows an attacker to overwrite heap memory in negative offsets, potentially causing the application to crash. An attacker would need to trick a user into opening a specially crafted image file, making this a local attack that depends on user interaction.

• CVE-2026-48734MEDIUM 5.5

  ImageMagick, a widely-used open-source image manipulation tool, contains a stack overflow vulnerability when processing specially crafted MVG (Magick Vector Graphics) files. An attacker can create a malicious MVG file that, when opened by a user in ImageMagick, causes the application to crash or become unresponsive. This occurs because the software fails to properly limit recursion depth or track which parts of the file it has already processed, allowing unbounded stack consumption. The vulnerability requires user interaction—someone must explicitly open the malicious file—but no special privileges are needed.

• CVE-2026-48735MEDIUM 5.5

  pypdf, a popular open-source Python library for PDF processing, contains a memory exhaustion flaw that allows attackers to craft malicious PDF files triggering excessive memory consumption. The issue stems from how the library parses XMP (Extensible Metadata Platform) metadata within PDFs—an attacker can embed large or unnecessarily complex metadata structures that force the parser to allocate abnormal amounts of RAM. This can degrade system performance or crash applications relying on pypdf to process untrusted PDF documents. The vulnerability affects versions prior to 6.12.1.

• CVE-2026-48985MEDIUM 5.5

  pam_usb is a Linux authentication module that lets users log in using removable USB devices. A bug in versions 0.9.1 and earlier causes the module to crash when it encounters certain output from the system's login service daemon. This crash can lock legitimate users out of services that rely on pam_usb for authentication, such as sudo or login commands. The issue stems from insufficient validation of data returned by the system, leading to a NULL pointer dereference. Version 0.9.2 contains the fix.

• CVE-2026-48991MEDIUM 5.5

  XianYuLauncher, a popular Minecraft Java Edition launcher, has a flaw in versions before 1.5.5 that allows a local attacker to steal authentication credentials during the login process. The vulnerability exists because the launcher uses a simple, predictable method to handle login on your computer without adequate security checks. If someone else can access your device or monitor your network traffic locally, they could intercept the authentication tokens needed to access your Minecraft account. The risk is highest in shared or untrusted computing environments. Updating to version 1.5.5 or later closes this gap.

• CVE-2026-49219MEDIUM 5.5

  ImageMagick, widely used for image processing and manipulation, contains a vulnerability that allows a local attacker with login privileges to bypass security policies and read files that should be restricted. The flaw stems from improper handling of filenames, specifically when symlinks are involved. An attacker could exploit this to circumvent the policy restrictions ImageMagick enforces. This is not a remote vulnerability—it requires local system access and user-level permissions.

• CVE-2026-49406MEDIUM 5.5

  Deno, a modern JavaScript and TypeScript runtime, has a path traversal vulnerability in its module resolver when operating in BYONM (Bring Your Own Node Modules) mode. A malicious package can craft a package.json file with directory traversal sequences (..) in its main field, causing Deno to load files from arbitrary locations on disk rather than from within the package's intended directory. Critically, this circumvents Deno's permission system—files that would normally be blocked by --allow-read restrictions can be read anyway if accessed through a require() call. The issue affects Deno versions prior to 2.7.12 and is resolved in that release.

• CVE-2026-49461MEDIUM 5.5

  CVE-2026-49461 is a denial-of-service vulnerability in pypdf, a widely-used Python library for PDF processing. An attacker can craft a malicious PDF file that causes excessive memory consumption when a user or application extracts text from a page containing a specially-constructed form XObject with self-referential loops. This does not allow data theft or system compromise, but can exhaust memory resources and crash applications that depend on pypdf. The vulnerability is resolved in version 6.12.2.

• CVE-2026-49495MEDIUM 5.5

  Ghidra, the NSA's reverse-engineering framework, contains a flaw that can crash the entire application when you open a specially crafted Mach-O binary file. The problem stems from how Ghidra parses export information in these binaries—if an attacker creates a file with circular references in its export structure, Ghidra will get stuck in an infinite loop, consuming memory until the Java runtime runs out and terminates. This causes the loss of any unsaved work in the active Ghidra session.

• CVE-2026-49760MEDIUM 5.5

  A stack-based buffer overflow exists in Erlang OTP's erl_interface library, specifically in the ei_s_print_term function. When this function processes Erlang terms with extremely large integer representations—those exceeding 2000 characters when encoded—it writes beyond the bounds of its internal 2000-byte stack buffer. The overflow is constrained to hexadecimal and decimal characters (0-9, A-F), which significantly limits the practical attack surface to denial of service rather than arbitrary code execution. The related ei_print_term function, which outputs to files instead of memory buffers, does not suffer from this flaw.

• CVE-2026-50135MEDIUM 5.5

  Hugo, a popular static site generator, contains a vulnerability in versions 0.123.0 through 0.161.1 that allows arbitrary file read when a symlink is present in local theme directories. If an attacker or compromised dependency places a malicious symlink in a theme folder (such as under `themes/`), Hugo's `resources.Get` function will follow that symlink and expose files readable by the Hugo process—potentially including sensitive configuration, environment variables, or other data. This affects only locally-mounted themes; remotely sourced Go modules from GitHub are unaffected because symlinks are stripped during download. The issue stems from a regression where the file system backend began using `Stat` (which follows symlinks) instead of `Lstat` (which does not).

• CVE-2026-50262MEDIUM 5.5

  CVE-2026-50262 is an information disclosure vulnerability in the X.Org X server and Xwayland components. A flawed validation check in the ChangeDrawableAttributes function allows an authenticated local attacker to read beyond the intended buffer boundaries, potentially exposing sensitive data from memory. The vulnerability is limited to information disclosure on standard configurations; a write variant exists but is disabled by default in most deployments.

• CVE-2026-50263MEDIUM 5.5

  CVE-2026-50263 is a use-after-free memory vulnerability in X.Org's X server and Xwayland components that can leak sensitive information from system memory. When a client manipulates window attributes and triggers the screen saver, the CreateSaverWindow() function accesses memory that has already been freed, allowing the attacker to read data that should no longer be accessible. The vulnerability requires local access and low privileges but can expose confidential information without crashing the system.

• CVE-2026-50810MEDIUM 5.5

  A flaw in GPAC's media processing code can cause the application to crash when handling certain streaming media files. An attacker could craft a malicious media playlist file that, when opened by a user, triggers a crash in the smooth_parse_stream_index() function. This is a local denial-of-service vulnerability requiring user interaction—someone must open a crafted file for the crash to occur.

• CVE-2026-50812MEDIUM 5.5

  A flaw in SQLite's Session Extension can crash applications using it when they process a specially crafted changeset file. An attacker with local access who can supply a malformed changeset blob can trigger a denial-of-service condition. The vulnerability stems from the code attempting to dereference a null pointer during changeset application, causing the application to terminate abnormally.

• CVE-2026-52753MEDIUM 5.5

  Ghidra, NSA's widely-used reverse engineering framework, has a memory exhaustion vulnerability in how it handles Rust symbol names. When analyzing a malicious binary containing specially crafted Rust symbols, Ghidra can allocate memory unboundedly, consuming all available RAM and crashing the application. An attacker would need to craft a binary that a security analyst then opens in Ghidra to trigger the crash—this is not remotely exploitable, but it can disrupt analysis workflows and impact incident response timelines.

• CVE-2026-52759MEDIUM 5.5

  Ghidra, the NSA's popular reverse-engineering framework, contains a vulnerability in how it processes Mach-O binary files (the executable format used by macOS and iOS). An attacker can craft a malicious binary with an invalid instruction count that tricks Ghidra into allocating enormous amounts of memory, exhausting system resources and crashing the application. This requires local access and user interaction—someone must open the malicious binary in Ghidra—but the impact is a reliable denial of service.

• CVE-2026-52904MEDIUM 5.5

  A memory leak exists in the Linux kernel's Nouveau graphics driver. During the device initialization process, if a specific system configuration check fails, the driver fails to properly clean up an allocated device object, leaving resources dangling in kernel memory. This is a kernel-level resource exhaustion issue that can be triggered by unprivileged users on affected systems.

• CVE-2026-52905MEDIUM 5.5

  A bug in the Linux kernel's DAMON (Data Access Monitoring) subsystem allows administrators or local users to configure memory monitoring settings with invalid parameters, potentially causing system instability or denial of service. The vulnerability stems from incomplete validation of the minimum region size parameter—it must be a power of two, but the DAMON sysfs interface can accept non-power-of-two values, leading to unaligned memory address ranges that violate kernel assumptions. This creates conditions for crashes or hangs during memory access monitoring operations.

• CVE-2026-52913MEDIUM 5.5

  A vulnerability in the Linux kernel's batman-adv networking module can cause a system crash when network interfaces are disabled. The issue stems from code that continues sending mesh network announcements (OGMs) through interfaces that have been taken offline, leading to attempts to access memory that no longer contains valid data. An unprivileged local user with access to the affected system could trigger this crash, resulting in a denial of service.

• CVE-2026-52916MEDIUM 5.5

  A flaw in the Linux kernel's batman-adv networking module allows a local attacker to crash the system by sending specially crafted fragmented network packets that nest themselves within each other. When the kernel attempts to reassemble these packets, it becomes trapped in recursive processing that consumes kernel stack memory until it runs out, causing a denial of service. The vulnerability requires local network access and appropriate user privileges to exploit.

• CVE-2026-52921MEDIUM 5.5

  A bug in the Linux kernel's netfilter ipset module causes certain hash-based set variants to iterate past their intended range boundaries when processing IPv4 addresses. When a user requests a range of IP addresses to be processed—for example, in firewall or traffic filtering rules—the iterator should stop after handling the last address in that range. Instead, it advances one more step, potentially moving the traversal state outside the original request boundary. This can cause problems on retry operations, where the system might resume from an incorrect position rather than the intended starting point. The issue affects four specific ipset hash variants used in network filtering configurations.

• CVE-2026-52925MEDIUM 5.5

  A Linux kernel vulnerability exists in Virtual Routing and Forwarding (VRF) port removal that can cause a system crash. When a network port is removed from a VRF configuration, the kernel may incorrectly assume it can access Layer 3 device operations on a newly assigned master device (like a bridge) that doesn't support those operations. This leads to a null pointer dereference—essentially the kernel trying to read data from a memory address that doesn't exist. The issue stems from insufficient synchronization during the port removal process, allowing RCU readers (kernel code paths that read without locks) to encounter inconsistent state.

• CVE-2026-52926MEDIUM 5.5

  A memory state management bug exists in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. When the mesh network is torn down, the code removes gateway nodes from the list but fails to clear the reference to the currently selected gateway. This leaves stale gateway state in memory that persists across cleanup operations. If the mesh is recreated later, this orphaned state can interfere with proper initialization and cause the mesh to malfunction. The fix is straightforward: clear the current gateway pointer before iterating through the gateway list during teardown.

• CVE-2026-52928MEDIUM 5.5

  A flaw in the Linux kernel's AF_UNIX socket implementation allows improper handling of the SIOCATMARK socket operation on datagram and sequenced packet sockets. SIOCATMARK is designed to check whether incoming data has reached an urgent marker—a feature that should only apply to stream-based sockets. The kernel currently does not reject this operation on other socket types, potentially leading to unexpected behavior or denial of service. The fix ensures SIOCATMARK returns an unsupported error for non-stream sockets, aligning the kernel's behavior with its own rules for out-of-band messaging.

• CVE-2026-52930MEDIUM 5.5

  A synchronization flaw in the Linux kernel's shared memory (shm) subsystem allows a local privileged attacker to cause a denial of service. The vulnerability exists in how the kernel decides when to clean up abandoned shared memory segments. The cleanup routine checks whether a segment is safe to destroy, but performs this safety check without holding the necessary lock, creating a race condition. Between the time the check passes and the segment is actually removed, another process can attach to it, leaving the kernel in an inconsistent state and potentially triggering a crash or hang.

• CVE-2026-52936MEDIUM 5.5

  This vulnerability describes a performance and availability issue in the Linux kernel's jitterentropy random number generator. The problem occurs because a critical lock (spinlock) is held for too long while the system performs expensive entropy collection and cryptographic operations. When multiple processes try to generate random numbers simultaneously, they waste CPU cycles spinning and waiting for the lock instead of sleeping, causing system slowdowns and potential denial of service. The fix replaces the spinlock with a mutex, allowing contending processes to sleep efficiently rather than spin, improving overall system responsiveness under load.

• CVE-2026-52937MEDIUM 5.5

  A vulnerability in the Linux kernel's tap network interface driver leaks sensitive kernel memory to unprivileged local users. When a user queries the hardware address of a tap or macvtap device using standard network tools, the kernel copies an incompletely initialized data structure to userspace, inadvertently disclosing 8 bytes of kernel stack contents. On systems running macvtap, this leak can expose kernel code pointers and direct-map memory addresses, undermining KASLR (kernel address space layout randomization) protections and providing attackers with information useful for exploiting other vulnerabilities.

• CVE-2026-52938MEDIUM 5.5

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) socket storage mechanism can cause a system crash when the kernel tries to access memory that no longer exists. The vulnerability occurs during a race condition where one part of the kernel clears a reference to storage data while another part is simultaneously trying to read it, resulting in a NULL pointer dereference. This affects scenarios where socket cloning happens during TCP connection establishment and when diagnostic tools query BPF socket storage. The issue is local to the system and requires user-level privilege to trigger.

• CVE-2026-52939MEDIUM 5.5

  A flaw in the Linux kernel's RDS (Reliable Datagram Sockets) over InfiniBand implementation causes a null pointer crash when handling masked atomic operations. When an unprivileged user sends certain atomic messages over an active RDS/IB connection, the kernel fails to properly track the request state, leading to a NULL dereference in interrupt context. This can crash the system or trigger a kernel panic. The issue only manifests on InfiniBand hardware that natively supports masked atomic operations, such as Mellanox MLX4 and MLX5 adapters.

• CVE-2026-52940MEDIUM 5.5

  A bug in the Linux kernel's TUN network interface code fails to properly clear memory before sending it to unprivileged users. When a user reads from a TUN device, the kernel copies a 24-byte header structure to userspace, but only initializes the first 10 bytes. The remaining 14 bytes contain leftover kernel memory from the stack—sensitive data that should never leave kernel space. An attacker with local user privileges can repeatedly read packets and collect fragments of kernel memory, potentially revealing sensitive information used internally by the kernel.

• CVE-2026-52941MEDIUM 5.5

  A vulnerability exists in the Linux kernel's SMC (Shared Memory Communications) networking implementation that can crash a system when tracing is enabled. Specifically, when a tracepoint used to monitor socket messaging is turned on, sending or receiving data over an SMC-D (Shared Memory Communications over DAPL) connection triggers a null pointer dereference. The kernel tries to access link information that doesn't exist for SMC-D sockets, causing a kernel panic. While enabling the tracepoint requires root access, unprivileged users can create SMC-D sockets and trigger the crash.

• CVE-2026-52944MEDIUM 5.5

  CVE-2026-52944 is a permission-bypass flaw in the Linux kernel's ksmbd (SMB server) implementation. The FSCTL_SET_SPARSE operation, which controls whether a file is marked as sparse (a storage optimization technique), fails to verify user permissions before allowing the change. This means an unprivileged user could modify file attributes they shouldn't be able to touch—either because they're on a read-only share or because they lack the necessary write permissions on a writable share. The vulnerability requires local access to trigger but could lead to unauthorized file attribute modifications.

• CVE-2026-52948MEDIUM 5.5

  A flaw in the Linux kernel's I2C device driver allows a local user to crash the system or leave I2C/SMBus hardware in a broken state. The vulnerability stems from an integer overflow when the driver processes timeout values submitted through a system call. An attacker with local access can supply a specially crafted timeout value that bypasses validation checks, causing the driver to set an invalid timeout internally. This leads to premature timeouts and corrupts the SMBus state machine, effectively denying service to legitimate I2C operations.

• CVE-2026-52949MEDIUM 5.5

  A flaw exists in the Linux kernel's memory management subsystem (DRM TTM) where the buffer object shrinking function can enter an infinite loop when a backup operation fails. This happens because the code attempts to remove a buffer from a tracking list before confirming the backup succeeded, leaving the list in an inconsistent state if the operation fails. The fix ensures the removal from the tracking list only occurs after a successful backup, preventing the infinite loop condition.

• CVE-2026-52961MEDIUM 5.5

  A bug in the Linux kernel's Ceph filesystem implementation can cause the system to crash when handling extended attributes (metadata tags attached to files). The problem stems from a timing issue where one part of the code calculates the size of attribute data while another part may simultaneously update that data, leading to an inconsistency. When the code later tries to verify the size matches expectations, the mismatch triggers a kernel panic. This affects systems using Ceph as a networked storage backend, particularly under specific file operation patterns.

• CVE-2026-52963MEDIUM 5.5

  A flaw exists in the Linux kernel's USB audio MIDI handling code. When processing USB MIDI endpoint descriptors, the kernel validates the size of internal descriptor structures but fails to properly bound subsequent reads against the actual available data. An attacker with local access could craft a malicious USB device that provides specially formatted MIDI endpoint descriptors, causing the kernel to read beyond allocated memory regions during descriptor parsing. This results in a kernel crash or denial of service.

• CVE-2026-52964MEDIUM 5.5

  A flaw in how the Linux kernel processes USB MIDI 2.0 device descriptors allows a malformed USB device to trigger an out-of-bounds memory read. When the kernel parses endpoint descriptors from a specially crafted MIDI 2.0 device, it fails to properly validate descriptor boundaries, potentially causing the parser to read memory beyond the intended descriptor region. This could lead to system crashes or information disclosure, but only affects systems where an untrusted USB device is connected and a user with non-root privileges interacts with MIDI functionality.

• CVE-2026-52965MEDIUM 5.5

  This is a memory management bug in the Linux kernel's graphics driver subsystem (DRM/TTM). When the kernel tries to move graphics memory to disk storage and that operation fails, it attempts to restore the memory's position in its tracking list. However, the restoration logic places the memory in the wrong position—ahead of where the system was searching—which causes the kernel to repeatedly examine the same memory block in an infinite loop. This infinite loop can freeze or crash the system. The fix involves changing when certain cleanup operations happen and how they handle memory marked as non-evictable.

• CVE-2026-52966MEDIUM 5.5

  A logic error in the Linux kernel's DRM (Direct Rendering Manager) subsystem can cause a denial of service when handling graphics device file descriptors. The bug stems from a recent change that failed to correctly update an internal pointer during memory management operations, leaving stale references that trigger a warning and potential crash when files are closed. This affects local users who can open DRM device files.

• CVE-2026-52970MEDIUM 5.5

  A memory management flaw exists in the Linux kernel's netfilter module, specifically in how it handles network connection expectations. When the system creates a temporary expectation object for tracking network connections, it fails to properly release the memory reference it holds. This creates a resource leak that can accumulate over time, eventually exhausting available memory and causing the system to become unresponsive or crash. The vulnerability requires local access to trigger, making it a lower-risk issue for most internet-facing systems but a concern for multi-user environments or systems where untrusted local users have access.

• CVE-2026-52972MEDIUM 5.5

  A vulnerability in the Linux kernel's cryptographic socket implementation allows a local attacker to trigger an arithmetic overflow when processing AEAD (Authenticated Encryption with Associated Data) operations. By crafting requests with excessively large associated data lengths, an attacker can cause a denial-of-service condition affecting system stability. The vulnerability requires local access and standard user privileges to exploit.