Open-Source Device CVEs: What to Patch by Vertical (October 2026)

This is the device stack beyond the kernel. It includes the C library, the media pipeline, the language runtimes, the network daemons and the container runtime that sit inside a shipped image. Which of these items matter to you depends on what is in your image and your software bill of materials (SBOM). The reporting window is 1 to 31 October 2026.

The EU Cyber Resilience Act requires manufacturers to keep an SBOM and to handle the known vulnerabilities in their products, so your SBOM is the list to check this report against. This month the largest groups of fixes were in GStreamer, the Node.js security release, and the network daemons dnsmasq and ConnMan.

We report a package issue only when it meets one of three tests. The CVSS base score is 7.0 or higher, or the issue is in the CISA KEV catalog, or it is clearly reachable in a normal device build. Scores come from the source named for each item. Projects, NVD and the CISA ADP do not always agree, and we say so where the gap is large. We leave out disputed issues and issues that need unusual build options. Kernel CVEs are not here. The weekly kernel advisory covers them.

Open-source device CVEs to update this month

Scoring notes and items we left out

A note on scoring. The curl score of 8.1 is from the CISA ADP, not from the curl project, which gives only a severity of High. The dnsmasq, ConnMan and Python scores are below 7.0 or come from a single scorer, and we list them because the code is reachable on a normal device. CVE-2026-93006 in dnsmasq needs an attacker on the same network segment, and the others need a network attacker. The Red Hat note for CVE-2026-93007 says the pool recovers after about 150 seconds and suggests raising --max-tcp-connections and limiting connections at the firewall. The expat and SQLite scores are from VulnCheck, which publishes CVSS 3.1 and CVSS 4.0 scores that differ by one to three points. The Python CNA score of 9.4 for CVE-2026-115557 is a hardening change, and we list it because the same compromised certificate authority appears in Node.js, Python and OpenJDK this month. The SQLite fix is shown as 3.54.0 because the CVE records say “before 3.54.0”. The 3.54.0 release notes do not name these two CVEs.

Two items need a careful reading. CVE-2026-111183 is scored under CVSS 3.0. The GStreamer advisory SA-2026-0088 says no CVE number is assigned, and the CVE link comes from the matching Zero Day Initiative identifier. It affects the RTP audio depayloaders in both gst-plugins-good and gst-plugins-base. CVE-2026-86476 is scored as local by Red Hat, but the advisory says the data may come from an untrusted network source. CVE-2026-119777 and CVE-2026-46472 come from GStreamer advisories dated April 2026, and NVD published them in October.

Other items we reviewed and left out. CVE-2026-95208 in wolfSSL (7.5 from the CISA ADP, affects 5.9.1 and 5.9.2) rests on a third-party write-up and has no wolfSSL advisory or fix commit. The latest release is 5.9.4 of 25 September, so it is probably not affected, but the release notes do not mention it. Treat it as a watch item. CVE-2026-97876 in GRUB2 is a Secure Boot bypass scored 6.4. It needs control of the GRUB configuration, is local only, and the fix is a commit that is not in a release yet. OpenSSH 10.6 was released on 6 October. Its CVEs score below 7.0 from the project, need GSSAPI or untrusted command-line input, or concern unusual platforms. NVD scores CVE-2026-106583 at 7.8 while the project scorer gives 2.5. The Microsoft OpenSSH for Windows CVEs belong to the Windows port and not to a Linux device build. In BusyBox, the October items are dpkg-deb, tar and httpd proxy issues that need non-default applets or a user to unpack an untrusted archive, and a udhcpc underflow scored 6.5. None has a release fix, because 1.38.0 is the newest. In SQLite, CVE-2026-119379 needs the session extension, which is off by default, and CVE-2026-119586 affects only the sqlite3 shell. For curl, the other 22 advisories of 14 October are rated Low by the project. In dnsmasq, CVE-2026-93011 needs DNSSEC enabled at runtime and CVE-2026-93009 and CVE-2026-93010 score 4.3. Three more expat issues (CVE-2026-117610, CVE-2026-118370, CVE-2026-113351) score 5.9 in CVSS 3.1 and 8.2 in CVSS 4.0, need unusual input such as a multi-gigabyte document, and are fixed as commits only. The six GnuTLS records of 8 October come from MITRE, score 6.5 or lower, and have no GnuTLS project advisory. For wolfSSH, a separate product, CVE-2026-83742 is scored 8.8 by NVD and 5.3 by the project, and it is fixed in 1.6.0. The systemd project published two local advisories in October, rated Moderate and Low, and we did not confirm CVE IDs for them.

Chromium has no October item in the KEV catalog. Google’s stable desktop updates of 27 and 29 October fix 52 and 21 issues, including four rated Critical on 27 October, and none is marked as exploited. If your device embeds Chromium through a browser component, take the Chrome 156 base, 156.0.8078.79 or later. We read only these two stable posts, and not the earlier October posts.

Packages checked this month with nothing that met the tests: U-Boot (no NVD record; see the next section), Trusted Firmware-A, musl, OpenSSL (the project’s newest advisory is dated 29 September), Mbed TLS, GnuTLS, wpa_supplicant and hostapd, NetworkManager, Dropbear, Avahi, WebKitGTK (the newest advisory is WSA-2026-0006 of 29 September), BlueZ (no advisory dated October), zlib (no release since 1.3.2), libxml2 (2.15.4 is the newest and NVD shows no record), xz (5.8.4 is dated 9 September), Mesa (26.2.5 and 26.2.6 list no CVEs, and one confidential issue in 26.2.6 is not described), runc and D-Bus. We could not read the D-Bus and libxml2 issue trackers, so tracker-only issues for those two are unchecked. We also read the October additions to the CISA KEV catalog, 36 entries. Only the Brotli entry matches this watchlist. The one Linux kernel entry is covered by the weekly advisory.

Carried over from earlier months

Several packages were also in the September edition. The patch table in this post is the authoritative one for them. containerd CVE-2026-95837 was flagged last month as rated Critical by the project with no CVSS. GitHub has now published 7.8. The fixed versions 2.2.7 and 2.3.4 are the same. GStreamer 1.28.7, which we named last month, does not clear this month: update to 1.28.8. Last month’s expat 2.8.5 and the Python releases 3.14.8, 3.13.16 and 3.12.15 are also superseded by 2.9.0, 3.14.10, 3.13.18 and 3.12.16. CVE-2026-102633 in expat, an integer overflow on 32-bit platforms, was published on 29 September and is also fixed in 2.9.0. This matters for 32-bit Arm images. BlueZ had no new advisory in October. We saw no release newer than 5.87, so the August and September BlueZ items from the earlier editions stay open as commits only. CVE-2026-88830 in BusyBox was published in September and still has no fix release. For U-Boot, last month we named 2026.10-rc5 as the baseline. GitHub now shows the tag v2026.10 dated 5 October. We did not read its release notes, so confirm on the U-Boot site that the final release contains the network boot fixes, and note that two September items were commits only.

Mobile and automotive

The C library and the media pipeline are the shared surface in a vehicle or phone platform. CVE-2026-84243 in glibc lets the LANGUAGE environment variable load a message catalog chosen by an attacker. The advisory says the attack needs an environment that crosses a trust boundary, such as an SSH setup that accepts the variable, and a crafted file placed by the attacker. The flaw itself dates from 2014, and only the CVE is new. Debian shows it as unfixed in every release, and 2.44 is affected. A patch was posted to the glibc mailing list on 12 October and is not merged. The advisory says setuid programs are not affected. Take your distribution’s patch when it appears, and do not pass LANGUAGE across a trust boundary until then.

For curl, CVE-2026-92392 is a use-after-free in HTTP/2 uploads. The project describes a working remote code execution case only under exact conditions, such as a known build, a known allocator and two parallel transfers. Update to 8.23.0. The fixes for the 8.20, 8.16 and 8.14 branches are builds of the commercial Rock-solid curl service, so on those branches ask your supplier or move to 8.23.0.

In the media pipeline, CVE-2026-111183 is the one to schedule first. A crafted RTSP stream or SDP description can make GStreamer write outside a heap buffer in the RTP audio depayloaders, and playbin and decodebin can load that code automatically. The CVE comes from the Zero Day Initiative. CVE-2026-86476 is scored as local, and it needs crafted video metadata from another process or a network source. CVE-2026-119777 needs a crafted H.266 file. CVE-2026-116612 and CVE-2026-46472 cover the editing-services project loader and an MP4 demuxer read. Update to 1.28.8 for all five. For FFmpeg, CVE-2026-107695 and CVE-2026-107696 are infinite loops in the HLS and RTSP code, reachable when the device opens a stream URL it does not control. Update to 8.1.3 for the first. We found no release fix for the second or for CVE-2025-52290, so cherry-pick or take your distribution’s package. Public proof-of-concept code is referenced for the two loop issues. ConnMan, used on some in-vehicle platforms, is covered under embedded devices below.

Embedded and IoT

On small devices the network daemons run as root and talk to the local network. CVE-2026-115863 is a stack overflow in the ConnMan DHCPv6 client. An attacker on the same link sends a forged router advertisement and then a forged DHCPv6 reply, and connmand crashes. The CVE text also describes writing past the end of the buffer. There is no fixed release: 2.0 is the newest and Debian shows it as vulnerable. Apply a patch from your distribution or the maintainers when one exists, and consider turning DHCPv6 off if the device does not need it.

For dnsmasq, three items are reachable in a normal build. CVE-2026-93007 lets a remote client exhaust the TCP DNS child processes, and UDP DNS keeps working. CVE-2026-93008 needs an attacker who controls a split-DNS upstream server, and then poisons the cache through CNAME targets. CVE-2026-93006 needs an attacker on the same network segment and matters only if the TFTP server is on, for PXE boot. Version 2.93 is affected and no fix release exists.

expat CVE-2026-77214 is a heap over-read when a caller passes a length to XML_ParseBuffer without a check, so it mostly matters for applications that call that function directly. CVE-2026-115506 makes untrusted XML use a lot of CPU because the entity expansion limit applies late. Update to 2.9.0 and watch for the commit for the second item. On 32-bit images, 2.9.0 also fixes CVE-2026-102633. For SQLite, update to 3.54.1. The FTS5 overflows matter if the device opens database files that someone else can write and FTS5 is built in. If you run Node.js on a gateway, update for CVE-2026-111497 as described below. Python CVE-2026-114583 matters if the device unpacks archives from outside, for example update bundles. Update to the release for your branch.

Cloud and datacenter

The Brotli bug CVE-2026-111497 is the highest priority item this month. CISA added it to the KEV catalog on 27 October, and the record shows active exploitation. It is an out-of-bounds write in the Brotli decoder. It can give remote code execution when an application decompresses attacker data. In Node.js that means the node:zlib Brotli functions. Update to 22.23.4, 24.22.1 or 26.12.1. The same Node.js release fixes CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069, which include two TLS hostname-check bypasses. Other products that bundle Brotli also need their own update, and the Brotli project fixed it in 1.0.10, 1.1.1 and 1.2.1.

For containerd, CVE-2026-95837 affects only hosts that use CRI checkpoint restore. Update to 2.2.7 or 2.3.4. Recreate any container that was restored from a checkpoint you do not trust. CVE-2026-47218 affects only hosts that run the containerd-shim-wasmtime shim from runwasi. It runs native code from an image layer outside the WASI sandbox. Update the shim to 0.6.1. The record says this does not by itself give host code execution. The curl, glibc and Python items in the sections above apply here too. Python CVE-2026-114583 is fixed in 3.14.10, 3.13.18, 3.12.16, 3.11.18 and 3.15.2.

The same compromised certificate authority, eMudhra, shows up in three places this month. Python 3.14.10 and the other October releases block its intermediate keys in the ssl module (CVE-2026-115557). Node.js updated its bundled certificate store. OpenJDK published two out-of-band advisories, CVE-2026-91403 on 21 October and CVE-2026-114820 on 24 October, both scored 9.1 and both in the TLS and security libraries. CVE-2026-91415 in Java 2D is remote without authentication. For all three Java items we could not confirm the fixed build numbers. The advisories list the builds that are still affected, such as 21.0.13.0.2 and 25.0.5.0.2. Use the newest build from your JDK vendor. If your images have their own certificate bundle, update the bundle and rebuild.

Medical devices

Connected medical devices draw their packages from the other stacks. The risk is whichever package is reachable from a network or parses untrusted clinical data. The clearest cases this month are the parsers. expat parses XML that often carries HL7 or FHIR content, so update to 2.9.0. SQLite holds device records and settings, so update to 3.54.1 if untrusted database files can reach it. FFmpeg and GStreamer handle imaging and endoscopy video: update GStreamer to 1.28.8, and update FFmpeg to 8.1.3 and then take the distribution package for the items without a release. The GStreamer RTP flaw is remote when the device receives an RTSP stream.

For network behaviour, dnsmasq runs on many hospital gateways, and curl is the usual client for update and telemetry traffic. Update curl to 8.23.0. glibc CVE-2026-84243 has no fix yet, so plan for the distribution package.

Medical-device updates go through validation and regulatory change control, including US FDA postmarket cybersecurity guidance, EU MDR and IEC 62304. The action is to schedule these updates through the device manufacturer’s change-control process, and not to patch a deployed device in place.

How to check if it applies to you

Three questions decide whether a row is your problem. First, is the package in your image and your SBOM? If it is not built into the product, its CVEs are not yours. Second, is the vulnerable feature built or enabled? Examples are FTS5 in SQLite, the TFTP server in dnsmasq, DHCPv6 in ConnMan, and CRI checkpoint restore in containerd. Third, is your version below the fixed version? Distributions often backport a fix without changing the upstream version number, so check your distribution changelog before you assume you are exposed. For packages with only a commit, compare the source tree with the commit instead of a version. These commands read three versions on a running device:

raghu@techveda.org:~$ curl --version | head -n 1
curl 8.20.1 (x86_64-pc-linux-gnu) libcurl/8.20.1 OpenSSL/3.5.9
raghu@techveda.org:~$ sqlite3 --version
3.53.2 2026-09-21 00:00:00
raghu@techveda.org:~$ python3 --version
Python 3.13.17

In this example, curl 8.20.1 is below the fixed 8.20.2, SQLite 3.53.2 is below 3.54.1, and Python 3.13.17 is below 3.13.18. Each update applies if the affected feature is in use. The output above is shortened and is an example, not a measured result.

Key takeaways

• October 2026 has 29 device-stack CVEs across 12 packages. One is in the CISA KEV catalog: the Brotli bug CVE-2026-111497, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.
• GStreamer has the most items. Update to 1.28.8. The RTP depayloader flaw CVE-2026-111183 is remote and scores 9.8.
• glibc, ConnMan and dnsmasq have no fix release. Use your distribution package or cherry-pick, and reduce exposure until then.
• Last month’s fixed versions for GStreamer, expat and Python no longer clear the month. Use 1.28.8, 2.9.0 and the October Python releases.
• The same compromised certificate authority appears in Python, Node.js and OpenJDK. Update the trust stores in your images as well as the packages.
• We could not read the D-Bus and libxml2 trackers or confirm CVE IDs for two systemd advisories. Treat those as unchecked.
• Check the build options. Several items apply only to specific features, such as FTS5, TFTP, DHCPv6 and CRI checkpoint restore.
• Map each CVE to your SBOM, confirm the feature is built and your version is below the fix, then update the package and rebuild the image.

Frequently asked questions

What are open-source device CVEs?
They are security vulnerabilities in the open-source packages that ship inside a device image, such as the C library, the network daemons, the media pipeline, the language runtimes and the container runtime. This roundup covers that device stack and leaves the Linux kernel to a separate weekly report.

Are any of these being exploited right now?
One is. CVE-2026-111497 is a Brotli decoder bug that CISA added to the Known Exploited Vulnerabilities catalog on 27 October 2026. Node.js fixed it in versions 22.23.4, 24.22.1 and 26.12.1. No other package in this roundup is in the catalog. Public proof-of-concept code is referenced for the FFmpeg issues CVE-2026-107695 and CVE-2026-107696 and the expat issue CVE-2026-115506. We found no evidence of exploitation of the others. Most items have a fix upstream, so the action is to schedule the update.

There is no release with the fix for glibc, ConnMan or dnsmasq. What do I do?
Take your Linux distribution’s patched package when it is available, or cherry-pick the fix commits into your build. The newest upstream releases are glibc 2.44, ConnMan 2.0 and dnsmasq 2.93, and all three are affected. Until a fix exists, reduce exposure: do not pass the LANGUAGE variable across a trust boundary, turn off DHCPv6 and the TFTP server if the device does not need them.

Why does last month’s advice not cover this month?
Several packages have newer fixes. GStreamer 1.28.7 does not include the October fixes, so update to 1.28.8. Expat 2.8.5 does not include the fix for CVE-2026-77214, so update to 2.9.0. Python 3.14.8 and the other September releases do not include the tarfile fix, so use 3.14.10 or the release for your branch. For U-Boot, check that you use the final 2026.10 release and not a release candidate.

Do I need to patch every package in the table?
No. Patch the packages that are in your image and your SBOM, whose vulnerable feature is built or enabled, and whose version is below the fixed version. The three checks in the section above narrow the table to the rows that affect your product.

How does this relate to the Cyber Resilience Act and the SBOM?
The Cyber Resilience Act expects a manufacturer to keep an SBOM and to handle the known vulnerabilities in the product. Your SBOM is the list you compare this report against. That turns a general CVE feed into a short, specific set of updates for your image.

Further reading

• Node.js October 2026 security releases
• curl vulnerability list
• glibc advisory GLIBC-SA-2026-0025
• ConnMan mailing list report
• dnsmasq changelog
• SQLite release history
• GStreamer security center
• Expat 2.9.0 release
• containerd advisory GHSA-p7v4-vr35-mj6f
• Python 3.14.10 release notes
• OpenJDK vulnerability advisories
• CISA Known Exploited Vulnerabilities catalog
• Debian security tracker
• CVE records: CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-92392, CVE-2026-84243, CVE-2026-115863, CVE-2026-93008, CVE-2026-93006, CVE-2026-93007, CVE-2026-119373, CVE-2026-119374, CVE-2026-107695, CVE-2026-107696, CVE-2025-52290, CVE-2026-111183, CVE-2026-86476, CVE-2026-116612, CVE-2026-119777, CVE-2026-46472, CVE-2026-77214, CVE-2026-115506, CVE-2026-95837, CVE-2026-47218, CVE-2026-114583, CVE-2026-115557, CVE-2026-91415, CVE-2026-91403, CVE-2026-114820, CVE-2026-102633