Red Hat Enterprise Linux 9 - CraftedSignal Threat Feed

CVE-2026-14476: SSSD AD GPO Provider Path Traversal to Root File Write and Authentication Bypass

hello@craftedsignal.io — Tue, 07 Jul 2026 10:19:46 +0000

A critical path traversal vulnerability, tracked as CVE-2026-14476, has been identified in the System Security Services Daemon (SSSD) AD GPO provider. This flaw resides within the ad_gpo_extract_smb_components() function, which fails to properly sanitize .. sequences embedded within the gPCFileSysPath LDAP attribute. This oversight enables an attacker, who has already secured Active Directory GPO management privileges, to craft a malicious attribute that directs file writes outside the intended GPO cache directory. Exploitation results in the ability to write arbitrary files as the root user on affected systems. Specifically, on default Red Hat Enterprise Linux (RHEL) configurations with SELinux in enforcing mode, this vulnerability can be leveraged to inject malicious Kerberos configuration, ultimately leading to an authentication bypass, compromising system integrity and access controls.

Attack Chain

An attacker gains or already possesses valid Active Directory GPO management credentials and access.
Using their GPO management privileges, the attacker modifies the gPCFileSysPath LDAP attribute to include .. path traversal sequences.
The crafted gPCFileSysPath attribute is designed to point to a sensitive system directory outside the normal GPO cache on the target SSSD-managed RHEL system.
When SSSD's ad_gpo_extract_smb_components() function processes this attribute, it inadequately sanitizes the .. sequences, misinterpreting the attacker's intended path.
This allows the attacker to write arbitrary files with root privileges to a chosen location on the affected RHEL system, bypassing normal file system permissions.
The attacker injects a malicious Kerberos configuration file (e.g., within /etc/krb5.conf.d/ or /etc/krb5.conf) into a directory that is processed by the system's Kerberos client.
The injected configuration manipulates Kerberos authentication parameters, potentially redirecting authentication requests or enabling compromise of Kerberos tickets.
This manipulation leads to an authentication bypass, granting the attacker unauthorized access or elevated privileges on the SSSD-managed RHEL system.

Impact

Successful exploitation of CVE-2026-14476 grants an authenticated attacker (with AD GPO management access) the ability to achieve arbitrary file write as root on targeted Red Hat Enterprise Linux systems. This level of access allows for critical system compromise, including the injection of malicious Kerberos configurations that can lead to a full authentication bypass. The consequence is a complete compromise of system integrity, confidentiality, and availability, enabling unauthorized access to sensitive data and critical system functions. Organizations relying on SSSD for Active Directory integration on RHEL are at risk, with potential for widespread compromise if AD GPO management systems are breached.

Recommendation

Patch CVE-2026-14476 by applying the latest security updates provided by Red Hat for SSSD to all affected Red Hat Enterprise Linux and OpenShift Container Platform installations.
Review and restrict Active Directory GPO management access to only necessary administrative accounts, following the principle of least privilege.
Monitor for unusual file creation or modification events in sensitive system directories (e.g., /etc/krb5.conf, /etc/krb5.conf.d/) on SSSD-managed RHEL systems.
Implement host-based intrusion detection systems to alert on unexpected changes to Kerberos configuration files or attempts to write files outside standard GPO cache locations.

CVE-2026-58384: GIMP PSD Parser Integer Overflow Leads to RCE/DoS

hello@craftedsignal.io — Tue, 07 Jul 2026 09:18:26 +0000

CVE-2026-58384 describes a critical flaw in the GIMP (GNU Image Manipulation Program) PSD (Photoshop Document) parser. Specifically, an integer overflow occurs within the read_RLE_channel() function. This vulnerability arises when processing specially crafted PSD files, causing an undersized heap allocation for the Run-Length Encoding (RLE) row-length table. Following this incorrect allocation, subsequent per-row writes attempt to use more memory than allocated, leading to heap memory corruption. This memory corruption can have severe consequences, including the application crashing (denial of service) or, in a more advanced scenario, the execution of arbitrary code on the affected system. The vulnerability has a CVSS v3.1 base score of 7.3 (High) and affects GIMP, including its package within Red Hat Enterprise Linux 9.

Attack Chain

An attacker crafts a malicious PSD file designed to trigger an integer overflow in GIMP's parser.
The malicious PSD file contains specially formatted RLE channel data intended to cause an undersized buffer allocation.
A user is enticed to open the malicious PSD file using an affected version of the GIMP application.
GIMP's read_RLE_channel() function begins processing the RLE channel data from the malicious file.
During the calculation for the RLE row-length table allocation, an integer overflow occurs due to the crafted input.
This integer overflow results in an undersized heap allocation for the RLE row-length table, creating a buffer overflow condition.
Subsequent writes by the read_RLE_channel() function, intended for per-row data, exceed the boundary of the undersized buffer, corrupting adjacent heap memory.
This heap memory corruption ultimately leads to either a denial-of-service condition (e.g., GIMP application crash) or, under specific exploit conditions, arbitrary code execution in the context of the user running GIMP.

Impact

The impact of CVE-2026-58384 is significant, potentially leading to application instability, data loss, or complete system compromise. If exploited for denial of service, GIMP users would experience application crashes, hindering productivity. More critically, successful exploitation for arbitrary code execution could allow an attacker to run malicious code with the privileges of the compromised user, potentially leading to further compromise of the system, data exfiltration, or installation of additional malware. While no specific victim counts or sectors are mentioned, any organization or individual using affected GIMP versions is at risk.

Recommendation

Update GIMP to a patched version immediately to remediate CVE-2026-58384, as referenced by the https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217 commit.
Apply security updates for Red Hat Enterprise Linux 9 if using the GIMP package, addressing CVE-2026-58384, as detailed in the Red Hat advisory https://access.redhat.com/security/cve/CVE-2026-58384.
Ensure all software, particularly applications that handle untrusted file formats, are kept up-to-date with the latest security patches.

CVE-2026-58380: GIMP PNM Parser Off-by-One Error Leads to RCE

hello@craftedsignal.io — Mon, 06 Jul 2026 15:25:56 +0000

CVE-2026-58380 details a critical vulnerability discovered in GIMP's PNM (Portable Anymap) image file format parser. The flaw resides within the pnmscanner_gettoken() function, where an off-by-one error during a loop boundary check causes a null terminator to be written one byte beyond the intended boundary of a stack-allocated buffer. This memory corruption is triggered when GIMP attempts to parse a specially crafted PNM file. While not yet observed in active exploitation, successful exploitation could lead to application instability and denial of service due to crashes, or, more severely, arbitrary code execution, granting an attacker control over the compromised system. This vulnerability affects various GIMP versions, including those shipped with Red Hat Enterprise Linux distributions.

Attack Chain

An attacker crafts a malicious PNM image file specifically designed to exploit the off-by-one error in GIMP's pnmscanner_gettoken() function.
The malicious PNM file is delivered to a victim through common vectors such as email attachments, malicious websites, or untrusted file shares.
The victim opens the specially crafted PNM file using the vulnerable GIMP application.
During the file parsing process, the pnmscanner_gettoken() function attempts to process the malicious input.
The off-by-one error causes a null byte to be written past the end of a stack buffer, corrupting adjacent memory.
This memory corruption disrupts program execution flow, leading to either an immediate application crash (denial of service) or, under controlled conditions, enables arbitrary code execution on the victim's system.

Impact

The vulnerability, CVE-2026-58380, carries a CVSS v3.1 Base Score of 7.3 (High), indicating significant potential impact. If successfully exploited, systems running vulnerable versions of GIMP could suffer from denial of service, where the application crashes, leading to loss of productivity. More critically, an attacker could achieve arbitrary code execution, allowing them to install malware, exfiltrate data, or gain full control over the compromised system. While there are no reports of in-the-wild exploitation, the widespread use of GIMP, particularly on Linux distributions like Red Hat Enterprise Linux, makes this a high-risk vulnerability.

Recommendation

Apply available patches for CVE-2026-58380 immediately to all GIMP installations, particularly on Red Hat Enterprise Linux systems, by referring to the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-58380.
Monitor Red Hat security channels for updates to affected products as detailed in the Red Hat advisory and apply them promptly.
Implement user awareness training regarding the risks associated with opening untrusted image files, especially those in less common formats like PNM.