CVE-2026-42014

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Scoring

Severity

MEDIUM

CVSS base score

6.6

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

EPSS probability

0.15%

CWE

CWE-825

Published

2026-06-16

Last modified

2026-09-14

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
• Red Hat Red Hat Update Infrastructure 5
• Red Hat Red Hat Update Infrastructure 5
• Red Hat Red Hat Update Infrastructure 5
• Red Hat Red Hat Update Infrastructure 5

Weakness type

• CWE-825

Related vulnerabilities

• CVE-2023-48316 — Azure RTOS NetX Duo Remote Code Execution Vulnerability
• CVE-2024-23310 — A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Ma
• CVE-2023-48692 — Azure RTOS NetX Duo Remote Code Execution Vulnerability
• CVE-2026-17523 — can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
• CVE-2023-48315 — Azure RTOS NetX Duo Remote Code Execution Vulnerability
• CVE-2024-39792 — NGINX Plus MQTT vulnerability
• CVE-2026-30978 — Heap-use-after-free in CIccCmm::AddXform()
• CVE-2024-8250 — Expired Pointer Dereference in Wireshark

Markdown version · Browse all CVEs