Vulnerability · Published Aug 7, 2026 · Assigned by redhat
CVE-2026-18938P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems
Medium 6.2
In plain English
A medium-severity heap buffer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | p11-kit | no fix listed | DEBIAN-CVE-2026-18938 |
| Debian:13 | p11-kit | no fix listed | DEBIAN-CVE-2026-18938 |
| Debian:14 | p11-kit | 0.26.5-1 | DEBIAN-CVE-2026-18938 |
| Ubuntu:22.04:LTS | p11-kit | 0.24.0-6ubuntu0.1 | USN-8687-1 |
| Ubuntu:22.04:LTS | p11-kit | 0.24.0-6ubuntu0.1 | UBUNTU-CVE-2026-18938 |
| Ubuntu:24.04:LTS | p11-kit | 0.25.3-4ubuntu2.2 | UBUNTU-CVE-2026-18938 |
| Ubuntu:24.04:LTS | p11-kit | 0.25.3-4ubuntu2.2 | USN-8687-1 |
| Ubuntu:26.04:LTS | p11-kit | no fix listed | UBUNTU-CVE-2026-18938 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Hardened Images | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-18938 vdb-entry, x_refsource_REDHAT
- RHBZ#2478995 issue-tracking, x_refsource_REDHAT