Open-Source Device CVEs: What to Patch by Vertical (July 2026)

Open-Source Device CVEs: What to Patch by Vertical (July 2026)



Tópico: Open-Source Device CVEs: What to Patch by Vertical (July 2026)
Categoria: Tutoriais | Programação & Tecnologia
Idioma Principal: Português (Conteúdo de Tecnologia)

Descrição do Conteúdo / Informações:
-------------------------------------------------------------------------
July 2026 brought 22 open-source device CVEs worth reviewing across the packages commonly shipped inside device images, not counting the Linux kernel. For the eight priority packages in the table below, an upstream fix or a patched update path was available when this review was compiled. None of these eight was in the CISA Known Exploited Vulnerabilities catalog at that time, and the action is the same in each case: update the affected package to the fixed version and rebuild your image. The eight packages are U-Boot, OpenSSH, curl, FFmpeg, GStreamer, Chromium, containerd, and Node.js.

This is the device stack beyond the kernel. It is the bootloader, the C library, the TLS and networking code, the media pipeline, and the container runtime that sit inside a shipped image. Which of these open-source device CVEs matter to you depends on what is actually in your image and your software bill of materials (SBOM). The EU Cyber Resilience Act creates software-inventory and vulnerability-handling duties that make SBOM-style tracking operationally necessary, so the SBOM is the list you check this report against. This month the crypto libraries were quiet: no CVE in OpenSSL, wolfSSL, Mbed TLS, or GnuTLS met this report's inclusion criteria in July. The pressure was on the bootloader, the remote-access tools, the media stack, and the container runtime.

We report a package CVE only when it meets one of three tests: a CVSS base score of 7.0 or higher, or a place in the CISA KEV catalog, or clear reachability in a normal device build. Severity numbers come from the source named for each item, because upstream projects, NVD enrichment, and downstream scorers such as the CISA ADP do not always score the same issue the same way; where the gap is large, we say so in the row. We skip disputed and build-option-only issues to keep the list short. Kernel CVEs are not here; they are covered by our weekly kernel advisory.



Open-source device CVEs to update this month


Package
CVE(s)
Bug type
Fixed version
Verticals

U-Boot
CVE-2026-29009, CVE-2026-29008
Buffer overflow in the NFS symlink reply (9. and integer underflow in the TCP receive path (7.5); both parse untrusted network data at boot. Reachable only when the network boot path is used
2026.07
Embedded/IoT, Mobile/Automotive, Medical

OpenSSH
CVE-2026-60002, CVE-2026-59999, CVE-2026-60000
Client use-after-free on a host-key change during rekey (9.4 from NVD, 7.7 from the OpenSSH CNA; client-side only); DisableForwarding not honored (7.5, sshd); GSSAPI auth denial-of-service (7.5, sshd)
10.4p1
Cloud/Datacenter, Mobile/Automotive, Medical

curl / libcurl

CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11352
HTTP/2 stream-dependency use-after-free; CA trust wrongly reused across connections; SSH host-key check skipped for scp/sftp; QUIC empty-datagram denial-of-service. curl rates these Low or Medium; the NVD scores of 7+ come from the CISA ADP auto-scorer, which curl disputes
8.21.0
Embedded/IoT, Mobile/Automotive, Cloud/Datacenter, Medical

FFmpeg
CVE-2026-64830, CVE-2026-64832, CVE-2026-66036, CVE-2026-66040 (4 of 14)
Heap out-of-bounds writes and a double-free in subtitle, hardware-decoder, filter, and encoder paths that parse untrusted media (7.1 to 8.
patched distro or vendor build with the fixes merged after 8.1.2 (no single release tag yet)
Mobile/Automotive, Medical, Embedded/IoT

GStreamer
CVE-2026-5056
Integer overflow and out-of-bounds write in the qtdemux MP4/MOV demuxer, leading to remote code execution (7.. Requires the qtdemux plugin and an untrusted MP4/MOV input
gst-plugins-good 1.28.2
Mobile/Automotive, Medical

Chromium
CVE-2026-14405, CVE-2026-15107, CVE-2026-15113
V8 uninitialized use (9.6); IndexedDB use-after-free (8.; Autofill use-after-free (9.6); each can lead to remote code execution or sandbox escape. Reachable when the device renders untrusted web content
150.0.7871.115
Mobile/Automotive, Medical, Cloud/Datacenter

containerd
CVE-2026-50195, CVE-2026-53492, CVE-2026-53488, CVE-2026-46680
Checkpoint image cache poisoning leading to code execution (9.9); CDI annotation injection (9.6); image LABEL leading to host command execution (8.; runAsNonRoot bypass (7.. The top two need the checkpoint/restore path; the others need an untrusted image

2.1.9 / 2.2.5 / 2.3.2 (and 1.7.33 on the 1.7.x branch)
Cloud/Datacenter, Embedded/IoT

Node.js
CVE-2026-58043
Permission Model over-grants filesystem access through path-prefix matching (7.5)

22.23.2 / 24.18.1 / 26.5.1

Cloud/Datacenter, Embedded/IoT

No affected package appears in the CISA KEV catalog for July 2026, so there is no "patch first because it is being exploited" signal this month. Order the work by severity and by reachability instead. The highest CVSS scores this month are containerd at 9.9 and 9.6, the U-Boot NFS overflow at 9.8, the OpenSSH client use-after-free at 9.4 (NVD; the OpenSSH CNA rates it 7.7), and the Chromium sandbox escapes at 9.6.

Watch items, not action items. Two packages had July issues that are outside the count of 22 and are not ready to patch yet. BusyBox had four denial-of-service bugs in its awk and ash applets (CVE-2026-38752 through CVE-2026-38755); the maintainers rate them low and local, and the fixes sit on the project mailing list with no tagged release. A batch of SQLite use-after-free CVEs (CVE-2026-51290 and neighbors) was filed against SQLite 3.41 with no upstream fix and no confirmation from the SQLite project. Track both, but do not schedule a patch yet.



Mobile and automotive


On automotive ARM SoCs that actually ship U-Boot, it runs first in the boot chain; many platforms instead use a vendor fork, a TF-A chain, or a proprietary first stage, so this row applies only where U-Boot is in the image. CVE-2026-29009 is a buffer overflow in the NFS symlink reply handler, and CVE-2026-29008 is an integer underflow in the TCP receive path. Both are reachable only when the board boots over the network, for example a factory or service netboot flow, because that is when U-Boot parses replies from an untrusted server. If your production units never netboot, the risk is low, but factory and repair images often do. Update to U-Boot 2026.07, which clears both; the TCP fix landed in 2026.04 and the NFS fix in the 2026.07 cycle.

OpenSSH is common for in-vehicle diagnostics and fleet management links. The most serious July issue, CVE-2026-60002, is a use-after-free in the SSH client that triggers when a server presents a changed host key during rekey. Update OpenSSH to 10.4p1. curl is used by telematics and over-the-air update clients that fetch data from the network, so the connection-reuse and HTTP/2 memory-safety fixes in 8.21.0 apply directly. The infotainment media pipeline is the largest surface: FFmpeg and GStreamer both decode untrusted media and network streams. FFmpeg had 14 out-of-bounds and double-free fixes in demuxers, hardware decoders, filters, and encoders; take your distribution's patched FFmpeg package or cherry-pick the commits merged after 8.1.2. GStreamer CVE-2026-5056 is a remote-code-execution bug in the qtdemux MP4/MOV demuxer, fixed in gst-plugins-good 1.28.2. Where the head unit renders an HTML interface with Chromium, update to 150.0.7871.115 for the V8, IndexedDB, and Autofill fixes.



Embedded and IoT


On small devices the bootloader and the network client are the parts that touch untrusted input. Update U-Boot to 2026.07 if the device boots over the network at any point in its life. Update curl to 8.21.0 if the device fetches configuration, telemetry endpoints, or firmware over HTTP, HTTP/2, or QUIC; the CA-trust reuse issue (CVE-2026-11564) weakens certificate checks across reused connections, and the scp/sftp host-key issue (CVE-2026-12064) skips the host-key check for those transfers. BusyBox also had four low-severity denial-of-service issues this month, but they are watch items rather than urgent patches, as noted in the box above. On edge gateways that run containers, the containerd and Node.js items below also apply.



Cloud and datacenter


The container runtime is the highest-severity item this month. containerd CVE-2026-50195 (9.9) is a checkpoint image cache poisoning bug that can lead to code execution, CVE-2026-53492 (9.6) injects untrusted CDI annotations from a checkpoint, and CVE-2026-53488 (8. turns a crafted image LABEL into host command execution. CVE-2026-46680 (7. lets a numeric user string bypass the runAsNonRoot control. Update containerd to 2.1.9, 2.2.5, or 2.3.2 depending on your branch, or 1.7.33 on the 1.7.x line. OpenSSH is the standard fleet-access tool; update to 10.4p1 for the client use-after-free and the two sshd issues. Node.js CVE-2026-58043 lets the Permission Model over-grant filesystem access through path-prefix matching; update to 22.23.2, 24.18.1, or 26.5.1. The same July Node.js release also fixed two HTTP/2 memory issues, so take the full release rather than a partial backport.



Medical devices


Connected medical devices draw their packages from the other three stacks, so the risk is whichever of these is network-reachable or parses untrusted clinical data. OpenSSH on a hospital gateway should move to 10.4p1. curl matters wherever the device retrieves data over the network, including image or record pulls, so update to 8.21.0. The media stack is directly relevant to imaging and endoscopy video: FFmpeg and GStreamer both parse untrusted media, so take the FFmpeg distribution update and GStreamer gst-plugins-good 1.28.2. Where a device presents a touchscreen UI built on Chromium or WebKitGTK, the browser-engine fixes apply; update Chromium to 150.0.7871.115. U-Boot applies to devices that netboot during service. The SQLite CVEs in the watch-items box matter here too, because SQLite frequently parses untrusted clinical data on these devices, but they are not ready to patch yet. Medical-device updates go through validation and regulatory change control, including US FDA postmarket cybersecurity guidance, EU MDR, and IEC 62304, so the action is to schedule these updates through the device manufacturer's established change-control process rather than patching in place.



How to check if it applies to you


Three questions decide whether any row above is your problem. First, is the package in your image and your SBOM at all? If curl or FFmpeg is not built into the product, its CVEs are not yours. Second, is the vulnerable feature actually built or enabled? The curl QUIC issue needs HTTP/3 support compiled in; the U-Boot bugs need the network boot path; the GStreamer bug needs the qtdemux plugin. Third, is your installed version below the fixed version? A quick check on the device answers the third question for the command-line tools:

[email protected]:~$ ssh -V
OpenSSH_10.2p1, OpenSSL 3.5.1 1 Jul 2025
[email protected]:~$ curl --version
curl 8.20.0 libcurl/8.20.0 OpenSSL/3.5.1 zlib/1.3.1

Here the client reports OpenSSH 10.2p1 and curl 8.20.0. Both are below the fixed versions (10.4p1 and 8.21.0), so both updates apply. For libraries without a version command, read the version from your SBOM or your build manifest and compare it to the fixed version in the table.



Key takeaways


• July 2026 had 22 open-source device CVEs worth reviewing across 8 watchlist packages; each has an upstream fix or a patched update path, and none is in the CISA KEV catalog.

• The highest-severity items are containerd (9.9 and 9.6, host code execution), the U-Boot NFS overflow (9., the OpenSSH client use-after-free (9.4), and the Chromium sandbox escapes (9.6).

• The media stack carried the most bugs: FFmpeg had 14 untrusted-media parsing fixes and GStreamer had a qtdemux remote-code-execution fix, which matters most for automotive infotainment and medical imaging.

• The curl and BusyBox NVD scores are inflated by the CISA ADP auto-scorer; the projects rate them lower, but taking the fixed release is still the right move.

• Map each CVE to your SBOM, confirm the feature is built and your version is below the fix, then update the package and rebuild the image.



Frequently asked questions


What are open-source device CVEs?

They are security vulnerabilities in the open-source packages that ship inside a device image, such as the bootloader, TLS and networking libraries, the media pipeline, and the container runtime. This roundup covers that device stack and leaves the Linux kernel to a separate weekly report.

Are any of these being exploited right now?

No package in this roundup was in the CISA Known Exploited Vulnerabilities catalog for July 2026, and we did not find published exploit code for these items, though that is not a guarantee that none exists. Each has an upstream fix or a patched update path, so the action is to schedule the update, not to respond to an active attack.

Why do the curl and BusyBox scores look high when the projects call them low?

The NVD scores of 7 and above for these come from the CISA ADP auto-scorer, which applies a generic network-attack profile. The curl and BusyBox projects score their own issues lower. We still recommend taking the fixed release, but you can weight these below the memory-safety and host-execution bugs.

FFmpeg shows no tagged release. How do I patch it?

The July FFmpeg fixes are merged in upstream git after 8.1.2, but no new 8.1.x release had shipped at month end. Take your Linux distribution's patched FFmpeg package, which most distributions have already published, or cherry-pick the listed commits into your build.

Do I need to patch every package in the table?

No. Patch only the packages that are in your image and SBOM, whose vulnerable feature is built or enabled, and whose version is below the fixed version. The three checks in the section above narrow the table down to the rows that affect your product.

How does this relate to the Cyber Resilience Act and the SBOM?

The CRA expects a manufacturer to keep an SBOM and to know which known vulnerabilities affect the product. Your SBOM is the list you compare this report against, which turns a general CVE feed into a short, specific set of updates for your image.



Further reading


• OpenSSH release notes (10.4): https://www.openssh.com/releasenotes.html

• curl security advisories: https://curl.se/docs/security.html

• U-Boot security notes: https://docs.u-boot.org/en/latest/develop/security.html

• FFmpeg security: https://www.ffmpeg.org/security.html

• GStreamer Security Advisory 2026-0016: https://gstreamer.freedesktop.org/security/sa-2026-0016.html

• containerd security advisories: https://github.com/containerd/containerd/security/advisories

• Node.js security releases: https://nodejs.org/en/blog/vulnerability/

• Original post on techveda.live: https://www.techveda.live/2026/07/31/open-source-device-cves-jul-2026/