Red Hat OpenShift AI 3.3 xdgmime Buffer Overflow Reachable by Unauthenticated Local Attackers (CVSS 7.1)
Last refreshed2026-10-30
Status: UPDATED
| Advisory ID: CVE-2026-16118
Key Details
CVE
CVE-2026-16118
CVSS Score / Version
7.1 (High) / CVSS v3.1
Updated
2026-10-29
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS Prose
attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is high.
Affected products
see table below
Classified as
CWE-122 (Heap-based Buffer Overflow)
Exploitation prediction (EPSS)
0.28% probability of exploitation in the next 30 days (19% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat OpenShift AI 3.3
Red Hat
Red Hat OpenShift AI 3.4
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat OpenShift AI 3.5
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Cert Manager support for Red Hat OpenShift release 1.20
Red Hat
Red Hat AI Inference Server 3.2
Red Hat
Red Hat OpenShift AI 3.0
Red Hat
Red Hat OpenShift AI 3.2
xdg
xdgmime
Red Hat
Red Hat Cost Management On-Premise 1
Red Hat
Red Hat AI Inference Server 3.5
Red Hat
Cert Manager support for Red Hat OpenShift release 1.17
Red Hat
Cert Manager support for Red Hat OpenShift release 1.18
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption. (NVD)
What to Do
Monitor Red Hat's and xdg's web pages for any future patch releases.