4520 matches found
CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
BIT-GOLANG-2026-56859 Add recursion depth guard during decode in encoding/xml
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
MAL-2026-14278 Malicious code in layer2-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f index.js line 75 decodes a base64-encoded string via Buffer.from..., 'base64'.toString'utf8' and passes the result to an evaluator, executing hidden...
CVE-2026-62291
libheif ≤1.23.0 allows attacker-controlled heap corruption (OOB write/read) via mismatched alpha plane dimensions during decode-and-re-encode. Fixed in 1.23.1; SUSE, openSUSE, and PT Security have issued updates. Exploitation in the wild is not reported. Patch: https://github.com/strukturag/libhe...
CVE-2026-62291 libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
CVE-2026-62291 libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
CVE-2026-62291
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
CVE-2026-62291: Out-of-bounds Read
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
PT-2026-77265
Name of the Vulnerable Software and Affected Versions libre versions prior to 4.8.1 Description The websock decode function in src/websock/websock.c contains an integer overflow during the validation of a masked WebSocket frame utilizing 64-bit extended length encoding. When the hdr-len variable ...
Linux Distros Unpatched Vulnerability : CVE-2026-72296
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes...
GHSA-MPWR-8VM7-H73F package pkcs12: Authentication bypass in Decode functions
Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...
package pkcs12: Authentication bypass in Decode functions
Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...
CVE-2026-71486
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100737)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100737 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmapdecode When decoding osdstate and osdweight...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100551)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100551 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinex...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100565)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100565 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak on SETACL decode failure nfsaclsvcdecodesetaclargs and...
CVE-2026-72296
In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...
CVE-2026-72466
Summary of CVE-2026-72466 : In the Linux kernel’s xprtrdma implementation, two path issues in rpcrdma_is_bcall() can leak the receive buffer and drain the Receive queue when decoding a reply. The speculative zero-byte peek uses xdr_inline_decode() without respecting xdr->end, allowing five sub...
