CVE-2026-85234: Red Hat Enterprise Linux 10

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 6
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8: before 0:5.2-28.el8_10 (fixed in 0:5.2-28.el8_10)
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Hardened Images

Published 2026-09-15. Last modified 2026-10-08.