CVE-2026-42014

A flaw was found in GnuTLS. The gnutls_pkcs11_token_set_pin function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

This vulnerability is rated as having a Moderate impact because exploitation requires local access and is confined to administrative token maintenance routines, primarily resulting in application crashes. While GnuTLS is broadly deployed across Red Hat Enterprise Linux, the vulnerable code path is only triggered when managing PKCS#11 hardware tokens or smart cards lacking a protected authentication mechanism. Standard TLS client and server network communications across Red Hat products are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.