<div class="container">
<h1>Security update for apache-pdfbox</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22088-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-06-08T14:37:00Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262046">bsc#1262046</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-3392.html">CVE-2026-3392</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-33929.html">CVE-2026-33929</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3392</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">1.9</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3392</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3392</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-33929</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-33929</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves two vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for apache-pdfbox fixes the following issues:</p>
<p>Update to version 2.0.36.</p>
<p>Security issues fixed:</p>
<ul>
<li>CVE-2026-33929: path traversal in the <code>ExtractEmbeddedFiles</code> example code can lead to arbitrary file writes
(bsc#1262046).</li>
</ul>
<p>Other updates and bugfixes:</p>
<ul>
<li>Version 2.0.36:</li>
<li>XMPBox removes namespaces on serialization</li>
<li>False negative on PDFA-1b validation : missing field type</li>
<li>PlainText.Paragraph.getLines extremely slow on long lines</li>
<li>Valid PDF/A 1B is rejected</li>
<li>Potential StackOverflows in BaseParser</li>
<li>Unknown code in Huffman RLE stream</li>
<li>IllegalArgumentException: Can't add attribute to 0-length text</li>
<li>TTFSubsetter.buildGlyfTable() modifies glyphIds while iterating over its entries possibly causing
ConcurrentModificationException to be thrown</li>
<li>IndexOutOfBoundsException in Type1CharStringParser.processCallSubr()</li>
<li>Exception "No type defined for {http://www.aiim.org/pdfa/ns/id/}rev" when trying to determine version of PDF/A-4
document</li>
<li>allow new PDF/A-4 conformance levels</li>
<li>pdfbox-app-X.X.X-sources.jar on maven central are empty (and javadoc jar is missing)</li>
<li>Cmd line docs</li>
<li>IllegalArgumentException: Multiplying two matrices produces illegal values in PDFStreamEngine.processAnnotation()</li>
<li>XmpParsingException: Schema is not set in this document: http://ns.adobe.com/xap/1.0/sType/ResourceEvent#</li>
<li>NullPointerException in FontMapperImpl.getFontMatches()</li>
<li>border style in FDFAnnotation is not initialized if width is 0</li>
<li>German umlauts are not rendered</li>
<li>Invalid type in Schema not detected when in XML attributes</li>
<li>Serializing produces date "1-01-01T00:00:00+01:00"</li>
<li>Seconds of date "D:2015-02-03T10:11:12" returned as 0</li>
<li>Confusing naming of "DerivedFrom" property getter in XMPMediaManagementSchema</li>
<li>ClassCastException in XMPMediaManagementSchema.getHistory()</li>
<li>IllegalArgumentException: Input buffer too short in StandardSecurityHandler.computeRC4key()</li>
<li>IllegalArgumentException: Width (0) and height (0) cannot be <= 0 when printing landscape rotated with
RASTERIZE_DPI_AUTO</li>
<li>DateConverter fails on valid date</li>
<li>ClassCastException: class org.apache.xmpbox.type.TextType cannot be cast to class
org.apache.xmpbox.type.ArrayProperty in DublinCoreSchema.getCreatorsProperty()</li>
<li>tiff:YCbCrSubSampling and tiff:YCbCrPositioning have wrong cardinality</li>
<li>ClassCastException: class org.apache.xmpbox.type.FlashType</li>
<li>Cannot find a definition for the namespace http://www.w3.org/1999/02/22-rdf-syntax-ns#, property:
rdf:Description http://ns.adobe.com/xap/1.0/sType/ResourceEvent#, property:stEvt:action</li>
<li>XmpParsingException: Missing pdfaSchema:property in type definition in lenient mode</li>
<li>XmpParsingException: Unknown property value type : Open Choice of Integer</li>
<li>XmpParsingException: Property 'CountryCode' not defined in http://www.epo.org/patent-bibliographic-data/1.0/</li>
<li>date "0-00-00T00:00:00-04:00" read as "0002-11-30T00:00:00-40:00"</li>
<li>XmpParsingException: Type 'stRef:documentName' not defined in http://ns.adobe.com/xap/1.0/sType/ResourceRef# in
lenient mode</li>
<li>Invalid PDF/A namespace definition, prefix: xmlns, namespace: http://www.aiim.org/pdfa/ns/extension/
http://www.aiim.org/pdfa/ns/extension/, property: pdfaExtension:schemas</li>
<li>NegativeArraySizeException in PredictorOutputStream()</li>
<li>NullpointerException in PDAcroForm.getField(Line 485)</li>
<li>OutOfMemoryError when trying to extract text from pdf</li>
<li>Outlines circular reference vulnerability</li>
<li>Rendered text missing</li>
<li>Inverted images due to enlarged decode array</li>
<li>PDF displays garbled characters in Adobe Reader but renders correctly in web browsers</li>
<li>NullPointerException while merging PDFs with output intents</li>
<li>Valid XMP Extension Schema rejected</li>
<li>Remove dead code from PDFMarkedContentExtractor</li>
<li>Include test file in test class</li>
<li>Get and Add PageTextSchema</li>
<li>Remove / deprecate TypeMapping.getAssociatedSchemaObject()</li>
<li>Support Seq / Bag mixup in lenient mode</li>
<li>Parse xmp files in lenient mode that have no processing instructions</li>
<li>deprecate getPDFIdentificationSchema() in favor of getPDFAIdentificationSchema()</li>
<li>Support TIFF-files with FillOrder=2 conversion to PDF</li>
<li>Remove / deprecate unused parts of PDIndexed</li>
<li>modernize rat exclusions</li>
<li>Version 2.0.35:</li>
<li>NegativeArraySizeException with PDF file with huge fonts</li>
<li>Inline image bug with multi-byte newline tokens</li>
<li>fix initial ByteArrayOutputStream size for deflate operation</li>
<li>PDF takes an hour to render</li>
<li>Splitter does not include structure tree in documents past the first split</li>
<li>build fails on jdk11</li>
<li>Load a TTF font which is from Mac OS throw an exception</li>
<li>Wrong glyphs since PDFBOX-5790</li>
<li>ClassCastException on broken file in PDEmbeddedFilesNameTreeNode.convertCOSToPD()</li>
<li>invalid XMP generated when Apache Xalan in the classpath</li>
<li>XMP JobType constructor ignores fieldPrefix</li>
<li>NullPointerException in xmpbox serializer if a date is empty</li>
<li>Rendering issue with type 2 shading: vertical expansion</li>
<li>Possible infinite loop in shading code</li>
<li>Potential OOM in XrefStreamParser</li>
<li>Potential StackOverflow in PDFStreamParser</li>
<li>Potential StackOverflow in PDPageTree's getInheritableAttribute</li>
<li>Potential OOM in Type1Lexer</li>
<li>Potential OOM in PfbParser</li>
<li>PDMarkedContentReference.setMCID() should not accept negative numbers</li>
<li>IllegalPathStateException: missing initial moveto in path definition</li>
<li>Fix possible ClassCastException</li>
<li>NullPointerException in COSDictionary</li>
<li>StringIndexOutOfBoundsException in PlainText$Paragraph.getLines()</li>
<li>LZWFilter crashes, probably not handling the KwKwK special case</li>
<li>NullPointerException in PDNumberTreeNode.getNumbers()</li>
<li>UnsupportedOperationException: JPX color spaces don't support drawing</li>
<li>Signing tries to set byteRange of old signature (2)</li>
<li>ClassCastException in PDOptionalContentProperties.getBaseState()</li>
<li>Add test for embedded files</li>
<li>set size for ByteArrayOutputStreams</li>
<li>avoid creation of temporary objects when parsing hex values</li>
<li>avoid unnecessary map lokups</li>
<li>remove unnecessary iteration and StringBuilder creation</li>
<li>Support reverse landscape orientation for printing</li>
<li>Add test coverage for orphan annotation</li>
<li>Remove orphan popup parent annotation</li>
<li>Improve XmpSerializer test by verifying its output</li>
<li>Consider rotation of page when applying overlay</li>
<li>Preserve Perms dictionary when signing</li>
<li>Check /ParentTree against /K tree</li>
<li>Add test for 5521</li>
<li>Refactor RC4Cipher</li>
<li>Regression tests for 2.0.35</li>
<li>Version 2.0.34:</li>
<li>PageDrawer is not rendering unrotatable Annotations on rotated pages</li>
<li>Zero-width non-joiner characters visible in generated PDF</li>
<li>Surrogate pairs with combining diacritics are incorrectly ordered on text extraction</li>
<li>TestCreateSignature.testCreateSignedTimeStamp checkLTV build test fail (2) / Support several issuers</li>
<li>IllegalArgumentException: Width (0) and height (0) must be non-zero</li>
<li>Merge docs with specific characteristics causes stack overflow - InvalidKeyException: Supplied key
(sun.security.ec.ECPrivateKeyImpl) is not a RSAPrivateKey</li>
<li>Can't read the embedded Type1 font: Found Token[kind=NAME,text=def] but expected begin</li>
<li>Wrong size entry in trailer after incremental save</li>
<li>FileSystemFontProvider doesn't register failed type1 fonts</li>
<li>Text annotation crosshair symbol too small when using Adobe symbol font</li>
<li>Orphan /OpenAction destination page kept in merge</li>
<li>PDFRenderer causes endless loop</li>
<li>Invalid stream length: 0, stream start position: <xxx></li>
<li>Inline image incorrectly parsed (2)</li>
<li>IllegalArgumentException: Not a valid Unicode code point: 0xE28496</li>
<li>Type 3 font glyphs not displayed</li>
<li>Rendered PDF is missing shading pattern graphics</li>
<li>NPE during merge</li>
<li>Class cast exception in building PDDestinationNameTreeNode</li>
<li>DomXmpParser incorrectly expects namespaces on attribute level</li>
<li>BDC processor mishandles property name</li>
<li>Can't render some Type1C fonts.</li>
<li>PDF to Image conversion results in a blank white page</li>
<li>Implement PDFormXObject.setGroup()</li>
<li>CertificateVerifier.isSelfSigned() should not throw an exception</li>
<li>Use Zapf Dingbats code for cross text annotation</li>
<li>Support PushPin, Tag and Graph file attachment annotation icons</li>
<li>Improve PDFMergerUtility memory footprint</li>
<li>Support rare RC4 encryption where R=4, key length < 128 bits</li>
<li>Improve checkWithNumberTree() test</li>
<li>Use SHA256 instead of MD5 for document id</li>
<li>Version 2.0.33:</li>
<li>Character positions shifted</li>
<li>Incorrectly extracted text (broken words)</li>
<li>Wrong color of uncolored tiling pattern</li>
<li>OutOfMemoryError - during renderImageWithDPI</li>
<li>BaseParser fails when a number is followed by a string starting with 'e'</li>
<li>Type3 font is not rendered</li>
<li>Flattening removes all annotations when widget annotation has no page</li>
<li>Image lost on page render</li>
<li>extra whitespaces when extracting Arabic text</li>
<li>SMaskInData not supported for JPX images</li>
<li>Kid Widget /DA is ignored in setDefaultAppearance() call</li>
<li>Radio button can't be set</li>
<li>the PDDocument.documentId does not seem to be written into the flat byteStream</li>
<li>PDFBox is unable to remove ID</li>
<li>Fix last step of the build process</li>
<li>StringIndexOutOfBoundsException in AppearanceGeneratorHelper</li>
<li>ClassCastException in SetLineJoinStyle.process()</li>
<li>Unable to load password protected pdf</li>
<li>PDFBox not extracting text of non-latin languages(tamil, bengali) properly but adobe reader's save as text does</li>
<li>Checkstyle</li>
<li>[PATCH] Detect CMYK image without relying on metadata</li>
<li>Regression from PDFBOX-5841: Text extraction with rotation magic fails for PDF with multiple content streams in a
page</li>
<li>PDF render blank page: The end of the stream doesn't point to the correct offset, using workaround to read the
stream, stream start position: 196, length: 0, expected end position: 196</li>
<li>CVE for Lucene libraries</li>
<li>The pattern created with PDFBox shows inconsistent colors between Safari and Adobe.</li>
<li>BDC sequence with resource reference instead of with MCID</li>
<li>StackOverflowError in PDFieldFactory.findFieldType</li>
<li>ClassCastException in AnnotationValidator</li>
<li>The CPU usage of a PDF file with a size of 85.6 MB is abnormal</li>
<li>Many ZapfDingbats symbols do not appear when page is rendered.</li>
<li>IOException when reading isolated "+"</li>
<li>IllegalArgumentException: capacity < 0: (-75475220 < 0) in RandomAccessReadBuffer constructor</li>
<li>FontBox spawns a <code>cmd</code> subprocess to read an environment variable (on Windows)</li>
<li>Implement PDF 2.0 dash phase clarification (2)</li>
<li>Particular PDF fails on renderImageWithDPI call</li>
<li>PDType0Font return invalid space width</li>
<li>Icons of text annotations sometimes too large</li>
<li>Orphan page check doesn't check annotation destinations</li>
<li>NPE in COSArray.indexOfObject</li>
<li>NPE in PagePane.mouseMoved()</li>
<li>ArrayIndexOutOfBoundsException in CMap.toInt()</li>
<li>Show ASN.1 decoded Contents for Signature-Dictionary</li>
<li>Exchange hard-coded values for variables and provide command-line options in TextToPDF component</li>
<li>Long rendering time of fonts in a specific PDF</li>
<li>Support imageio-jnr / imageio-openjpeg library for JPEG2000 decoding</li>
<li>Improve ExtractTTFFonts</li>
<li>Change Loglevel from Warn to info when rebuilding font cache</li>
<li>Support OCG visibility expressions</li>
<li>Add page getter/setter to PDObjectReference</li>
<li>Support long values for COSInteger objects</li>
<li>Empty constructor for PDViewerPreferences</li>
<li>Add check of /P to PDFMergerUtilityTest</li>
<li>support Markdown extraction from the command line</li>
<li>Calculate dpi dynamically when printing with raster</li>
<li>Remove orphan annotations in structure tree</li>
<li>Add font name to PrintTextLocations</li>
<li>Improve detection whether printing or viewing</li>
<li>Hi CPU and memory usage when converting a PDF with type 4 shading</li>
<li>2.0 builds fail on jenkins because jdk11 no longer supported</li>
<li>Version 2.0.32:</li>
<li>preflight-app fails on Java 11+ with NoClassDefFoundError: javax/activation/DataSource</li>
<li>AppearanceGeneratorHelper assumes fontscale 1000</li>
<li>Remove release subproject</li>
<li>Don't use a predefined CMap if a ToUnicode CMap is present</li>
<li>Regression NPE in Splitter</li>
<li>The content of the specified font is lost, Google Chrome can display it</li>
<li>Crash for Softmask with incorrect backdrop color components</li>
<li>Observable Timing Discrepancy (Timing Attack)</li>
<li>Black rectangle over image</li>
<li>Wrong font substitution for Wingdings</li>
<li>PDDocument#importPage slowed down by factor 1300</li>
<li>Split aborts with broken destinations</li>
<li>IllegalArgumentException: Parameter must be 1-based, but is 0 when using PDFTextStripperByArea</li>
<li>Files created with PDFMergerExample are not correct PDF/A</li>
<li>Missing /Subtype and /Type in Metadata not detected</li>
<li>Multiple exceptions coming from org.apache.fontbox.ttf for different PDFs</li>
<li>IOException: Error expected floating point numberactual='-12.-1'</li>
<li>NullPointerException: Cannot invoke "String.codePointAt(int)" because "uni" is null</li>
<li>DomXmpParser - IllegalArgumentException: prefix cannot be "null" when creating a QName</li>
<li>ClassCastException: org.apache.pdfbox.cos.COSNull cannot be cast to org.apache.pdfbox.cos.COSDictionary</li>
<li>IllegalArgumentException: Width (26) and height (0) must be non-zero</li>
<li>There is an exception when getting embedded font, is it compatible?</li>
<li>Infinite loop after splitting and saving PDF / giant result files</li>
<li>JPEGFactory. Reduce logging severity when no image metadata is present</li>
<li>Add test for surrogate pair character ð© ̧1⁄2</li>
<li>Update unicode Scripts.txt</li>
<li>Include a PDFA check with VeraPDF for CreatePDFATest</li>
<li>Add center constructor parameter to PDFPageable and to pdfbox-app</li>
<li>When splitting, keep named page destinations that are part of target document(s)</li>
<li>When this PDF is rendered with the "f" Operator, a black screen appears.</li>
<li>Investigate why we get "response contains wrong nonce value" during build tests</li>
<li>Version 2.0.31:</li>
<li>[PATCH] Split pdf lose accessibility tags</li>
<li>Allow creating of PDFXObjectImage without accessing to the image stream</li>
<li>PfbParser fails to parse PFB font with multiple binary records.</li>
<li>Lines vanish when printing on MacOS</li>
<li>java.lang.IllegalArgumentException: Provided dictionary is not of type 'COSName{OCG}'</li>
<li>The embedded font DroidSansFallbackFull reports an error when parsing, and finally uses lastResortFont, resulting in
garbled fonts.</li>
<li>COSName caches already cached hashCode</li>
<li>Font operation takes a long time with 3.0.1</li>
<li>NullPointerException in TTFSubsetter.buildPostTable()</li>
<li>Problem converting PDF to image (java.awt.color.CMMException: Can not access specified profile)</li>
<li>Set the default value for PDNonTerminalField</li>
<li>java.lang.ArrayIndexOutOfBoundsException Bug Report</li>
<li>Wrong colors in PDF since PDFBOX-5488</li>
<li>Java 7 support on 2.0</li>
<li>Convert to image exception</li>
<li>PDF conversion in this format is very slow. Is there any room for optimization?</li>
<li>IllegalArgumentException: -Infinity is not a finite number</li>
<li>Inconsistent signature page handling when signing in existing signature fields</li>
<li>Add leading "0" for octal values in MacOSRomanEncoding</li>
<li>DataFormatException: invalid distance too far back</li>
<li>Grayscale JPEG rendered multicolor</li>
<li>OutOfMemoryError in FileSystemFontsProvider.scanFonts</li>
<li>NPE in PageDrawer.getPaint()</li>
<li>Issue with embedded Font and descendant Font</li>
<li>LCMS error 13: Mismatched alpha channels</li>
<li>Enable Native Markdown Extraction in Apache PDFBox</li>
<li>When splitting, keep page destinations that are part of target document(s)</li>
<li>Replace Exception with some repair attempt</li>
<li>Version 2.0.30:</li>
<li>Regression unicode mapping in Korean document</li>
<li>Operators "q" and "Q" should also preserve text matrices</li>
<li>Signature Image not Rendered starting with PDFBox 2.0.23</li>
<li>Fonts are not subsetted when saving incrementally</li>
<li>Bug in PDFMergerUtility#mergeFields</li>
<li>Password protected PDF opens in GUI apps but PDFbox says invalid password</li>
<li>Wrong error message "2.4.1 : Invalid Color space, The operator "rg" can't be used with CMYK Profile"</li>
<li>Make FDF annotations more compliant with the specification</li>
<li>NPE in DomXmpParser.parseLiDescription</li>
<li>Regression: NoSuchElementException in PDFXrefStreamParser</li>
<li>The PageDrawer.strokePath method is blocked, and cpu100%</li>
<li>Avoid NPE when processing CFF2 based fonts</li>
<li>IllegalArgumentException: Dimensions (width=458477041 height=26) are too large</li>
<li>Can not see checkbox check</li>
<li>NPE when converting pdf to image.</li>
<li>NullPointerException in XMPMetadata.getSchema()</li>
<li>PDFToImage might not correctly detect unsupported image formats</li>
<li>Font cache isn't effective on my machine, always rebuilds</li>
<li>PDF to Image conversion results in different converted image</li>
<li>Text in a certain font is lost when converting pdf to image</li>
<li>Incorrect colors in image from PDFs (DCTDecode)</li>
<li>Inconsistent/incomplete PDF rendering</li>
<li>Improve code quality (4)</li>
<li>Add PDRectangle#TABLOID paper size</li>
<li>Support version 0.5 of MaximumProfileTable</li>
<li>loca-table isn't mandatory for TTF/OTF-fonts using CFF outlines</li>
<li>Implement PDF 2.0 dash phase clarification</li>
<li>Add getter and setter for the CO array under PDAcroForm</li>
<li>Make UTC timezone static</li>
<li>Facilitate migration to PDFBox 3.0</li>
<li>Consolidate bouncycastle configuration</li>
<li>Consistent scm.url values for pom.xml</li>
<li>use comparison operators for enums</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-905=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-905=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>apache-pdfbox-2.0.36-160000.1.1</li>
<li>apache-pdfbox-javadoc-2.0.36-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>apache-pdfbox-2.0.36-160000.1.1</li>
<li>apache-pdfbox-javadoc-2.0.36-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-3392.html">https://www.suse.com/security/cve/CVE-2026-3392.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-33929.html">https://www.suse.com/security/cve/CVE-2026-33929.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1262046">https://bugzilla.suse.com/show_bug.cgi?id=1262046</a>
</li>
</ul>
</div>