CVE-2026-6678

MediumCVSS 5.3/10Last modified Jul 1, 2026

Description

Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-191

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jul 1, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-667806.5A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, posseCVE-2026-667815.4A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPseCVE-2026-667825.8A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer tCVE-2026-667834.4A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cCVE-2026-667858.7A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clustCVE-2026-667869.1A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource DeCVE-2026-667878.7A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficieCVE-2026-667889.9A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespCVE-2026-66797.5A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow wCVE-2026-667929.9A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate theirCVE-2026-667938.8A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permCVE-2026-667949.3A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated