Libxml2, Red Hat Operator Flaws Lead CVEs
Critical libxml2 flaws and a Red Hat Observability Operator privilege escalation dominate today's CVEs, with OpenShift and container image library vulnerabilities also noted.
Two critical vulnerabilities in libxml2 (CVE-2025-49796, CVE-2025-49794) allow for memory corruption and use-after-free flaws when processing specially crafted XML files. These issues, detailed in CISA ICS Advisories concerning Siemens Ruggedcom Rox and SINEC OS, could lead to crashes or potential exploitation by malicious actors. Red Hat has flagged these as high-risk, emphasizing the need for prompt patching.
A high-severity flaw in the Red Hat Observability Operator (CVE-2025-2843) grants excessive privileges. The operator incorrectly creates a ServiceAccount with broad ClusterRole permissions, even for namespace-scoped custom resource monitors. This could allow a Kubernetes account with minimal privileges to escalate its access significantly within the cluster.
The OpenShift build process is affected by a high-severity vulnerability (CVE-2024-45497) where the docker-build container mounts sensitive kubelet configuration files. This mount exposes credentials that could be leveraged by an attacker within a build pod to compromise the underlying node or other cluster resources.
A vulnerability in the github.com/containers/image library (CVE-2024-3727) could enable attackers to trigger unauthenticated registry accesses. This flaw may lead to resource exhaustion, local path traversal, and other security risks by impersonating victim users during registry interactions.
Medium-severity issues were also noted, including unnecessary RBAC permissions in Submariner (CVE-2024-5042) that could allow a privileged attacker to steal service account tokens, and an overly permissive TrustyAI component in Red Hat OpenShift AI Service (CVE-2025-12103) granting broad pod access. Additionally, GNU Coreutils' sort utility has a heap buffer under-read vulnerability (CVE-2025-5278).
Several low-severity vulnerabilities were disclosed across various projects, including buffer overflows in libjxl (CVE-2026-52584), issues with signature verification in Sigstore (CVE-2026-49834), and potential remote code execution via HTTP requests in a Ruby CSS parser (CVE-2026-53727). Other low-severity findings include information disclosure in SimpleSAMLphp (CVE-2026-49284), Content-Security-Policy bypass in GitHub's secure_headers (CVE-2026-54163), OS command injection in systeminformation (CVE-2026-50289), constant-time execution flaws in RustCrypto CMOV (CVE-2026-50185), and vulnerabilities related to message size limits and header encoding in websocket-driver (CVE-2026-54465, CVE-2026-54464, CVE-2026-54463). Netty (CVE-2026-44891) and Debian's urwid (CVE-2026-9323) also had low-severity findings.