CLSA-2026-1789565568
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1789565568.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789565568
- Upstream
- Published
- 2026-09-16T13:32:59Z
- Modified
- 2026-10-26T09:32:02Z
- Summary
- Fix CVE(s): CVE-2026-86421
- Details
-
- SECURITY UPDATE: memory leak in the MSL group handler
- debian/patches/CVE-2026-86421.patch: destroy the per-level DrawInfo in the unwind of MSLEndElement. The unwind released the image, the attributes and the image_info of every level it popped, but never the DrawInfo that MSLPushImage clones for that level, so each nested element leaked one DrawInfo (coders/msl.c)
- debian/patches/CVE-2026-86421-1.patch: bound that unwind loop so a stale group_info numImages count cannot drive msl_info->n below zero. This version predates upstream 8867bada, so the loop had no bound and the DrawInfo destroy added above would otherwise widen the existing out-of-bounds free by one pointer (coders/msl.c)
- debian/patches/CVE-2026-86421-2.patch: destroy the per-level DrawInfo in MSLPopImage() too. MSLPopImage handles the pop outside a group and is disjoint from the unwind patched above; this version predates upstream 08278c7c (first released in 6.9.10-0), so without it a crafted MSL document repeating ... still leaks one DrawInfo per pop (coders/msl.c)
- CVE-2026-86421
- SECURITY UPDATE: memory leak in the MSL group handler
- References