CVE-2026-111127

The catdoc utility (versions through 0.95 ) is vulnerable to an out-of-bounds read in the copy_unicode_string() function located in src/xlsparse.c. This flaw stems from an unchecked string character count , where an attacker can provide a crafted .xls file declaring 0xFFFF two-byte characters wit...

CVE-2026-111127 catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...

CVE-2026-111127

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...

CVE-2026-111125

CFITSIO versions through 4.7.0 are vulnerable to a heap-based out-of-bounds read in the HCOMPRESS tile decoder. The flaw exists in fits_hdecompress.c within the input_nnybble function, where a crafted FITS file using ZCMPTYPE HCOMPRESS_1 and oversized tile geometry can cause the application to re...

CVE-2026-111126 catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...

EUVD-2026-102357

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...

CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111126

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...

EUVD-2026-102356

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111125 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111126

The catdoc software (versions through 0.95 ) is vulnerable to an out-of-bounds read in the MULRK record handler of the process_item() function located in src/xlsparse.c. An attacker can supply a specially crafted .xls workbook or BIFF stream with a large endcol value to the xls2csv utility. This ...

EUVD-2026-102355

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111124 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111124

The CFITSIO library through version 4.7.0 contains a heap-based out-of-bounds read vulnerability within the imcompress.c unquantize helpers. The root cause is triggered by a zero or negative ZDITHER0 seed, allowing attackers to read memory located before the fits_rand_value table. An attacker can...

EUVD-2026-102354

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111123

FluidSynth versions through 2.6.1 are vulnerable to an out-of-bounds write (CWE-787) caused by unvalidated SoundFont modulator destination values. By crafting an SF2 file with PMOD/IMOD destinations ranging from 63 to 255 , an attacker can trigger a write past the voice generator array and update...

CVE-2026-111123

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...