What you need to know today.
Heap overflow in Binutils and container escape in CRIU disclosed, alongside multiple Linux kernel and Xen vulnerabilities.
A heap buffer overflow in the BFD DLX ELF backend of GNU Binutils allows an attacker to write out-of-bounds, potentially leading to code execution. This vulnerability, tracked as CVE-2026-18220, affects the processing of relocation entries in ELF files. Users should update to a patched version of Binutils as soon as possible.
A container escape vulnerability in CRIU (Checkpoint/Restore In Userspace) has been identified as CVE-2026-18107. This flaw allows an attacker to hijack a critical section during checkpoint/restore operations, potentially enabling a container escape. Prompt patching or updating of CRIU is recommended to mitigate this risk.
A use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP component, CVE-2026-64557, could allow for privilege escalation or denial-of-service. The vulnerability occurs in the l2cap_sock_new_connection_cb() function during connection handling. Updating the Linux kernel to a patched version is advised.
A race condition in the persistent connections handling of the excon Ruby gem, before version 0.71.0, could lead to data being left on a socket after an interruption. This data could then be read by subsequent requests, potentially causing unexpected behavior or information disclosure. Users of excon should upgrade to version 0.71.0 or later.
Several vulnerabilities have been disclosed in Apache ActiveMQ. CVE-2026-61487 allows an authenticated low-privilege user to bypass per-destination write ACLs by sending data to a temporary composite destination. Additionally, CVE-2026-59878 is an improper input validation flaw in the AMQP NIO connector that can be triggered by a remote unauthenticated peer, leading to a denial-of-service. Users of Apache ActiveMQ should consult vendor advisories for specific mitigation and update instructions.
A series of use-after-free and out-of-bounds read vulnerabilities have been identified in the pglogical component, tracked under CVE-2026-50738, CVE-2026-50737, CVE-2026-50736, and CVE-2026-50735. These flaws relate to worker signaling, default expression evaluation, queue mechanism execution, and message field validation, potentially allowing for privilege escalation or denial-of-service. Applying patches or updates for pglogical is recommended.
Multiple vulnerabilities in the libfsimage library's iso9660 driver, including CVE-2026-42495, CVE-2026-42494, and CVE-2026-62423, stem from deriving lengths directly from the file system structure without sufficient validation. This could lead to out-of-bounds reads or other memory corruption issues. Users of libfsimage should update to a secure version.
Several Xen vulnerabilities have been disclosed, including CVE-2026-62432, a NULL pointer dereference in the EVTCHNOP_expand_array hypercall due to a race condition. CVE-2026-62429 involves improper synchronization when accessing vNUMA configuration data during guest destruction. CVE-2026-62426 relates to insufficient checks in sysctl and platform operations management. CVE-2026-62433 describes an issue in DM_OP handling where buffer requirements are not validated, potentially leading to stack corruption. Finally, CVE-2026-62431 involves an unchecked divisor in Viridian STIMER handling, which can lead to a division-by-zero fault. Users of Xen should apply relevant security updates.