CVE-2026-1288
published 2026-06-17CVE-2026-1288: A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability…
PriorityP418medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.12%
1.9th percentile
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autodesk | revit | >= 2024 < 2024.3.5 | 2024.3.5 |
| autodesk | revit | >= 2024.0.0 < 2024.3.5 | 2024.3.5 |
| autodesk | revit | >= 2025 < 2025.4.5 | 2025.4.5 |
| autodesk | revit | >= 2025.0.0 < 2025.4.5 | 2025.4.5 |
| autodesk | revit | >= 2026 < 2026.4.1 | 2026.4.1 |
| autodesk | revit | >= 2026.0.0 < 2026.4.1 | 2026.4.1 |
| autodesk | revit | >= 2027 < 2027.1 | 2027.1 |
| autodesk | revit | >= 2027.0.0 < 2027.1.0 | 2027.1.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cvelistv5v3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CVEList
RFA File Parsing Vulnerability in Autodesk Revit
cvelistv5·2026-06-17·CVSS 5.5
CVE-2026-1288 [MEDIUM] CWE-476 RFA File Parsing Vulnerability in Autodesk Revit
RFA File Parsing Vulnerability in Autodesk Revit
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
GHSA
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability.
ghsa_unreviewed·2026-06-17
CVE-2026-1288 [MEDIUM] CWE-476 A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability.
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
VulDB
Autodesk Revit up to 2024.3.4/2025.4.4/2026.4.0 RFA File null pointer dereference
vuldb·2026-06-17
CVE-2026-1288 [LOW] Autodesk Revit up to 2024.3.4/2025.4.4/2026.4.0 RFA File null pointer dereference
A vulnerability classified as problematic was found in Autodesk Revit up to 2024.3.4/2025.4.4/2026.4.0. Affected by this vulnerability is an unknown functionality of the component RFA File Handler. Executing a manipulation can lead to null pointer dereference.
The identification of this vulnerability is CVE-2026-1288. The attack can only be executed locally. There is no exploit available.
Upgrading the affected component is advised.
GHSA
Keycloak Services has Improper Validation of Consistency within Input
ghsa·2026-05-27
CVE-2026-9689 [MEDIUM] CWE-1288 Keycloak Services has Improper Validation of Consistency within Input
Keycloak Services has Improper Validation of Consistency within Input
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
Red Hat
keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change
vendor_redhat·2026-07-16·CVSS 5.5
CVE-2026-15943 [MEDIUM] CWE-1288 keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change
keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improp
Red Hat
keycloak-services: keycloak-services: OIDC email_verified claim incorrectly applied to userinfo email
vendor_redhat·2026-07-05·CVSS 4.8
CVE-2026-14781 [MEDIUM] CWE-1288 keycloak-services: keycloak-services: OIDC email_verified claim incorrectly applied to userinfo email
keycloak-services: keycloak-services: OIDC email_verified claim incorrectly applied to userinfo email
A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token.
The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email.
Exploitation Conditions:
Th
Red Hat
golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
vendor_redhat·2026-06-25·CVSS 7.5
CVE-2026-46601 [HIGH] CWE-1288 golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
A flaw was found in the `golang.org/x/image/webp` library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service (DoS) for applications processing such images.
Statement: Red Hat products are not affected by this vulnerability. The vulnerable WebP decoder in golang.org/x/image/webp is present as a transitive dependency but is never imported or called by any affected product. VolSync is a storage replicat
Red Hat
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
vendor_redhat·2026-06-22·CVSS 5.9
CVE-2026-53538 [MEDIUM] CWE-1288 python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
A flaw was found in Python-Multipart, a tool used for processing web form data. A remote attacker co
Red Hat
kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
vendor_redhat·2026-05-28·CVSS 7.0
CVE-2026-46117 [HIGH] CWE-1288 kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface (uAPI) that cause an internal error. This issue arises when Work Queues (WQs) are specified to share the same Completion Queue (CQ), leading to an unstable system state.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Af
Red Hat
kernel: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-45873 [LOW] CWE-1288 kernel: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
kernel: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
No description is available for this CVE.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 9) - Fix deferred
Red Hat
keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604
vendor_redhat·2026-05-27·CVSS 4.2
CVE-2026-9689 [MEDIUM] CWE-1288 keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604
keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
Statement: This Moderate severity flaw in Keycloak arises from HTTP parameter pollution when a clie
Red Hat
kernel: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-46002 [LOW] CWE-1288 kernel: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
kernel: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
A flaw was found in the Linux kernel's ext2 filesystem. A local attacker could create a specially crafted filesystem image with malformed inodes (index nodes) that, when mounted, would not be properly rejected by the ext2_iget() function. This could lead to a kernel warning and potentially a system crash, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affe
Red Hat
kernel: erofs: fix inline data read failure for ztailpacking pclusters
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-45943 [MEDIUM] CWE-1288 kernel: erofs: fix inline data read failure for ztailpacking pclusters
kernel: erofs: fix inline data read failure for ztailpacking pclusters
A flaw was found in the Linux kernel's erofs filesystem. This issue occurs when compressed folios for ztailpacking pclusters are not validated before being added to I/O chains. An attacker could potentially trigger a NULL pointer dereference, leading to a system crash and a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not aff
Red Hat
kernel: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
vendor_redhat·2026-05-06·CVSS 5.5
CVE-2026-43081 [MEDIUM] CWE-1288 kernel: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
kernel: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
A flaw was found in the Linux kernel's Integrated Packet Accelerator (IPA) driver. Incorrectly configured register field masks for IPA version 5.0 and newer could lead to system instability. This issue may manifest as a warning when attempting to send commands to the MPSS remoteproc, potentially resulting in a denial of service where the system fails to operate as intended.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linu
Red Hat
kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
vendor_redhat·2026-05-06·CVSS 5.5
CVE-2026-43265 [LOW] CWE-1288 kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for x86 architectures. A local user or a malicious guest operating system could manipulate the virtual CPU (vCPU) state by injecting events while the vCPU is in a blocking state. This could lead to a spurious exit to userspace, potentially causing the virtual machine to crash, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: ke
Red Hat
kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-31709 [HIGH] CWE-1288 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
A flaw was found in the Linux kernel's Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat E
Red Hat
kernel: btrfs: reject root items with drop_progress and zero drop_level
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-43046 [MEDIUM] CWE-1288 kernel: btrfs: reject root items with drop_progress and zero drop_level
kernel: btrfs: reject root items with drop_progress and zero drop_level
A flaw was found in the Linux kernel's btrfs filesystem. This vulnerability allows an attacker with local access to trigger a kernel bug (system crash) by providing specially crafted, malformed btrfs metadata on disk. Specifically, an invalid state where drop_progress.objectid is non-zero and drop_level is zero in a root_item is not properly validated when read from disk. This can lead to a denial of service (DoS) when the system attempts to recover relocation or drop a snapshot.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affecte
Red Hat
kernel: ext4: reject mount if bigalloc with s_first_data_block != 0
vendor_redhat·2026-04-22·CVSS 5.5
CVE-2026-31447 [MEDIUM] CWE-1288 kernel: ext4: reject mount if bigalloc with s_first_data_block != 0
kernel: ext4: reject mount if bigalloc with s_first_data_block != 0
A flaw was found in the `ext4` filesystem component of the Linux kernel. This vulnerability occurs when a local user attempts to mount an `ext4` filesystem that is configured with `bigalloc` and a non-zero `s_first_data_block` value, a configuration that is not supported. The consequence is a Denial of Service (DoS), as the system will reject the mount operation, preventing access to the filesystem.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: k
Red Hat
kernel: crypto: algif_aead - Revert to operating out-of-place
vendor_redhat·2026-04-22·CVSS 5.5
CVE-2026-31431 [MEDIUM] CWE-1288 kernel: crypto: algif_aead - Revert to operating out-of-place
kernel: crypto: algif_aead - Revert to operating out-of-place
A flaw was found in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect 'in-place operation' was introduced, where the source and destination data mappings were different. This could lead to unexpected behavior or data integrity issues during cryptographic operations, potentially impacting the reliability of encrypted communications.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 8) - Fix deferred
P
Red Hat
avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
vendor_redhat·2026-04-03·CVSS 5.5
CVE-2026-34933 [MEDIUM] CWE-1288 avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.
A flaw was found in Avahi. An unprivileged local user can exploit this vulnerability by sending a D-Bus method call with conflicting publish flags. This can lead to a denial of service (DoS) by crashing the avahi-daemon, making the service unavailable.
Package: avahi (Red Hat Enterprise Linux 10) - Fix deferred
Package: avahi (Red Hat Enterprise Linux 6) - Fix deferred
Package: avahi (Red Hat Enterprise Linux 7) - Fix d
Red Hat
kernel: netfilter: nft_set_rbtree: validate open interval overlap
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23333 [LOW] CWE-1288 kernel: netfilter: nft_set_rbtree: validate open interval overlap
kernel: netfilter: nft_set_rbtree: validate open interval overlap
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: validate open interval overlap
Open intervals do not have an end element, in particular an open
interval at the end of the set is hard to validate because of it is
lacking the end element, and interval validation relies on such end
element to perform the checks.
This patch adds a new flag field to struct nft_set_elem, this is not an
issue because this is a temporary object that is allocated in the stack
from the insert/deactivate path. This flag field is used to specify that
this is the last element in this add/delete command.
The last flag is used, in combination with the start element cookie, to
check if there is a partial overl
Red Hat
kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23310 [LOW] CWE-1288 kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
In the Linux kernel, the following vulnerability has been resolved:
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
bond_option_mode_set() already rejects mode changes that would make a
loaded XDP program incompatible via bond_xdp_check(). However,
bond_option_xmit_hash_policy_set() has no such guard.
For 802.3ad and balance-xor modes, bond_xdp_check() returns false when
xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually
absent due to hardware offload. This means a user can:
1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode
with a compatible xmit_hash_policy (e.g. layer2+3).
2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.
Red Hat
kernel: net: usb: kaweth: validate USB endpoints
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23312 [LOW] CWE-1288 kernel: net: usb: kaweth: validate USB endpoints
kernel: net: usb: kaweth: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: validate USB endpoints
The kaweth driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
A flaw was found in the Linux kernel's kaweth driver. A malicious USB device can exploit this vulnerability by not providing the expected number and types of USB endpoints during device probing. The driver fails to validate these endpoints, leading to an attempt to blindly access them, which can cause the driver to crash. This results in a Denial of Service (D
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published