CVE-2026-42014: gnutls28 Expired Pointer Dereference
CVSS: 6.6v3.1MediumAwaiting analysis
AliasesALPINE-CVE-2026-42014SUSE-SU-2026:3042-1UBUNTU-CVE-2026-42014DEBIAN-CVE-2026-42014
Published 16-06-2026Last modified 14-10-2026
Vulnerability summary
CVE-2026-42014 is a medium (CVSS 6.6) Expired Pointer Dereference vulnerability in gnutls28. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.2% of scored vulnerabilities.
CVSS score
6.6/10
010
Medium · v3.1 (CVE.org)EPSS score
0.20%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 6Timeline
- 16-06-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- OSV · DebianEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- NVDNIST6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
+0.05 pp
From 0.15% on 19-09-2026
19-09-202619-10-2026
EPSS score0.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse10 products
- gnutls&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.7.3-150400.4.62.1
- gnutls&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.7.3-150400.4.62.1
- gnutls&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 3.7.3-150400.4.62.1
- gnutls&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 3.7.3-150400.4.62.1
- gnutls&distro=SUSE Linux Enterprise Micro 5.4< 3.7.3-150400.4.62.1
Alpine1 product
- gnutls< 3.8.13-r0
Debian1 product
- gnutls28< 3.7.9-2+deb12u7 | < 3.8.9-3+deb13u4 | < 3.8.13-1
Ubuntu1 product
- gnutls28< 3.6.13-2ubuntu1.12+esm3 | < 3.7.3-4ubuntu1.9 | All versions (No fix recorded) | < 3.7.3-4ubuntu1.9+Fips1 | < 3.8.3-1.1ubuntu3.6 | < 3.8.3-1.1ubuntu3.6+Fips1.2 | < 3.8.9-3ubuntu2.2 | < 3.8.12-2ubuntu1.1
4 vendors · 13 products
