CVE-2026-89078 and CVE-2026-93577: GitLab CE/EE contain a double free and an integer overflow that let an authenticated user run arbitrary c

GitLab CE/EE contain two vulnerabilities tracked as CVE-2026-89078 (double free) and CVE-2026-93577 (integer overflow). Both allow an authenticated user to run arbitrary code. The event comes from the CVE.org record and does not include a CVSS score or exploitation status, but the description confirms both are memory corruption flaws in GitLab's codebase that lead to arbitrary code execution under authentication. No observed exploitation is reported in the event, but the combination of authentication bypass potential and RCE capability makes these critical for GitLab instances.

The event is a new update (masto:117322967115223879) assigned to the existing GitLab CVE cluster. The double free and integer overflow suggest low-level memory safety issues, likely affecting specific GitLab components. Administrators running GitLab CE or EE should review the CVE records at cve.org for affected versions and apply patches immediately. Because both CVEs require authentication, the attack surface is lower than unauthenticated RCE, but compromised accounts or insider threats could exploit them easily. Monitor GitLab's security releases for remediation timelines.