CVE Feed

    Dashboard / CVE / CVE-2026-102474

    CVE-2026-102474

    A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

    Published:Sep 29, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 29, 2026
    EPSS Score:0.00144
    CVSS Score:4

    Affected Products

    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-121611 (CVSS 6.5) — A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in…
    CVE-2026-121601 (CVSS 6.1) — A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF …
    CVE-2026-119610 (CVSS 8.2) — A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When proc…
    CVE-2026-121629 (CVSS 7.5) — A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist…
    CVE-2026-123876 (CVSS 4.4) — A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK …
    CVE-2026-120749 (CVSS 6.2) — A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl mo…
    CVE-2026-121995 (CVSS 7.5) — A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub…
    CVE-2026-123151 (CVSS 7.5) — A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can…
    CVE-2026-121996 (CVSS 8.2) — A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to r…
    CVE-2026-121997 (CVSS 8.1) — A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High