Vulnerabilities
GitLab CVE-2026-97229: Unauthenticated Remote Code Execution via CI/CD Regex Overflow
A critical integer overflow in GitLab’s CI/CD regex compiler allows unauthenticated remote code execution on self‑managed instances. Attackers must first inject a malicious .gitlab-ci.yml into a public repository. Immediate patching of all unpatched GitLab CE/EE deployments is required.
What happened
GitLab released a critical patch for CVE-2026-97229, an integer overflow in the CI/CD regex compiler that can be triggered by a specially crafted regular expression stored in a .gitlab-ci.yml file. The flaw is rated CVSS 10.0 and can lead to arbitrary code execution on the application worker.
Impact
All self-managed GitLab Community and Enterprise editions are affected. The vulnerability requires the attacker to commit a malicious CI file to a public project; self-registration or public repositories remove this barrier. GitLab.com and Dedicated customers are already patched.
What to do
- Verify the GitLab version on all self-managed instances.
- Apply the latest patch (v15.10.3 or later) immediately, bypassing normal patch windows.
- Audit repositories for unexpected .gitlab-ci.yml files and enforce branch protection.
- Consider disabling public project creation or requiring review of CI files.
Mitigation details
Patch updates replace the vulnerable regex engine; no configuration changes are required beyond installing the new release. For environments that cannot upgrade immediately, restrict write access to CI configuration files and monitor for anomalous regex patterns.
Related vulnerabilities
Critical GitLab CE/EE Vulnerability (CVE-2026-97229) – Immediate Upgrade Required
An integer‑overflow flaw in GitLab’s CI/CD regex compiler (CVE‑2026‑97229) allows unauthenticated code execution on self‑managed instances. All GitLab Community and Enterprise Editions older than 19.4.2, 19.3.4, or 19.2.8 must be patched immediately, prioritizing internet‑facing deployments.
Read briefing
CVE-2026-102856: Visio RCE via Heap Overflow
A heap-based buffer overflow vulnerability exists in Microsoft Visio. Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution. Defenders should prioritize patching Visio installations.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
CVE-2026-83748: Windows Error Reporting Remote Code Execution via Heap Overflow
A heap-based buffer overflow in Windows Error Reporting enables remote code execution by unauthenticated attackers. The flaw can be exploited over a network, allowing arbitrary code execution on affected systems. Apply the latest Microsoft security update or disable the Error Reporting service to mitigate the risk.
Read briefing