Veille CVE

Mercredi 9 septembre 2026

4 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Container Platform 4 » ✕
  1. CVE-2026-87876 3.0 Faible

    Red Hat Hardened Images · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

  2. CVE-2026-87875 4.3 Moyenne

    Red Hat Hardened Images · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

  3. CVE-2026-87853 7.5 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

  4. CVE-2026-86564 3.3 Faible

    Red Hat Fast Datapath for RHEL 10 · Red Hat Fast Datapath for RHEL 8 · Red Hat Fast Datapath for RHEL 9 · Red Hat Enterprise Linux 10

    A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.