GNU vulnerabilities
We track 100 vulnerabilities in GNU products across 26 products. 100 are rated high or critical, and 5 have been exploited in real attacks. The most recent was published on October 11, 2026.
Latest GNU vulnerabilities
- 7.8 High severity
Emacs: Incomplete List of Disallowed Inputs
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
- 7.0 High severity
libextractor: Untrusted Search Path
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a mal
- 7.5 High severity
Emacs: Inclusion of Functionality from Untrusted Control Sphere
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to
- 7.5 High severity
libextractor: Memory Allocation with Excessive Size Value
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that al
- 7.1 High severity
Emacs: Out-of-bounds Read
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dim
- 8.6 High severity
Bison: Improper Neutralization of Special Elements used in an OS Command
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define too
- 7.5 High severity
gawk: Stack-based Buffer Overflow
Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It
- 9.1 Critical severity
gawk: Integer Overflow or Wraparound
Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and belo
- 9.1 Critical severity
gawk: Integer Overflow or Wraparound
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects
- 7.5 High severity
gawk: Use After Free
Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.
- 7.5 High severity
gzip: Buffer Over-read
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across t
- 8.8 High severity
InsightConnect Sed Plugin: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.
- 7.3 High severity
libredwg: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The
- 7.5 High severity
GNU SASL: NULL Pointer Dereference
In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.
- 7.5 High severity
Red Hat Enterprise Linux 10: Undefined Behavior for Input to API
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets w
- 9.8 Critical severity
Red Hat Enterprise Linux 10: Improper Null Termination
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username,
- 7.4 High severity
Red Hat Enterprise Linux 10: Improper Handling of Case Sensitivity
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remot
- 9.1 Critical severity
Red Hat Enterprise Linux 10: Integer Underflow (Wrap or Wraparound)
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disc
- 7.1 High severity
Red Hat Enterprise Linux 10: Off-by-one Error
A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS (Cascading Style Sheets) data. A local user could exploit this by convincing a victim to open a malic
- 7.8 High severity
Red Hat Hardened Images: Heap-based Buffer Overflow
A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which
- 7.5 High severity
Red Hat Hardened Images: NULL Pointer Dereference
A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer derefer
- 7.1 High severity
Red Hat Hardened Images: Out-of-bounds Read
A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF objec
- 7.1 High severity
Red Hat Hardened Images: Out-of-bounds Read
A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object
- 9.8 Critical severity
inetutils: Buffer Copy without Checking Size of Input
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
- 7.5 High severity
Binutils: Double Free
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a resu
- 7.5 High severity
Binutils: NULL Pointer Dereference
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resul
- 7.8 High severity
inetutils: Inclusion of Functionality from Untrusted Control Sphere
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIR
- 9.8 Critical severity
GNU InetUtils Argument Injection Exploited
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
- 8.8 High severity
Wget2: Stack-based Buffer Overflow
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit
- 9.8 Critical severity
Wget2: Improper Limitation of a Pathname to a Restricted Directory
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the sy
- 7.5 High severity
Recutils: Divide By Zero
A divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to cause a Denial of Service (DoS) via inputting an empty value as a password.
- 7.5 High severity
An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows…
An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
- 7.5 High severity
Binutils: Stack-based Buffer Overflow
An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
- 7.5 High severity
An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26…
An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
- 7.5 High severity
Binutils: Uncontrolled Resource Consumption
An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
- 7.5 High severity
Binutils: Heap-based Buffer Overflow
A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
- 7.8 High severity
grub2: Use After Free
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the or
- 8.7 High severity
GNU libbmicrohttpd: Heap-based Buffer Overflow
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker
- 8.7 High severity
GNU libbmicrohttpd: NULL Pointer Dereference
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker
- 7.8 High severity
Binutils: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The expl