EUVD-2026-101138

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Apsortcmp and...

CVE-2026-110715

The MuJS JavaScript engine, versions 1.3.6 before 1.3.9 , contains a heap out-of-bounds read and write vulnerability in the Array.prototype.sort function. An attacker can supply JavaScript that inflates a dense array's length, causing the Ap_sort_cmp and Ap_sort_swap functions to access memory sl...

EUVD-2026-101137

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

CVE-2026-110714

The libsmb2 library, versions through 6.2 , is vulnerable to a heap out-of-bounds read caused by an integer underflow in the decode_acl function. A malicious SMB server or an attacker intercepting an unsigned session can trigger this by sending a crafted QUERY_INFO reply with an AclSize value bel...

CVE-2026-110713

The libsmb2 library through version 6.2 is vulnerable to a heap out-of-bounds read in the smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info functions. This flaw occurs because malicious SMB servers can send crafted QUERY_INFO replies with oversized or missing name lengths, ca...

CVE-2026-110713 libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...

EUVD-2026-101136

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

EUVD-2026-101135

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712

The libsmb2 library (versions through 6.2 ) contains a heap out-of-bounds read vulnerability within the smb2_decode_file_all_info function. The root cause is an unchecked FileNameLength parameter. A malicious SMB server or an attacker performing a man-in-the-middle attack on unsigned sessions can...

EUVD-2026-101133

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221lib.c, whose bit reader refills without checking the datau32 array end. Attackers can supply crafted .s14 or .sss files that drive decodevectorquantizedmltindices past the stack buffer...

CVE-2026-110661

The CGNS software (versions through 4.5.2 ) is vulnerable to a stack out-of-bounds read within the ADFI_read_node_header function. The root cause is a lack of proper null-termination in the end tag of .cgns or .adf files, which causes ADFI_stridx_c to scan past the disk_node_data memory. This vul...

EUVD-2026-101134

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFIreadnodeheader that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFIstridxc to scan past disknodedata,...

CVE-2026-110660

The software vgmstream through r2117 contains a stack out-of-bounds read vulnerability within the G.722.1/Siren14 decoder (specifically in g7221_lib.c). The root cause is that the bit reader refills without verifying the data_u32 array end. An attacker can provide specially crafted .s14 or .sss f...

EUVD-2026-101131

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

CVE-2026-110658 Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

CVE-2026-110658

Sofia-SIP versions through 1.13.18 are vulnerable to a heap out-of-bounds read in the msg_multipart_parse() function. An unauthenticated remote attacker can trigger this vulnerability by sending an INVITE request with a multipart Content-Type where the boundary exceeds the actual body length. Thi...

EUVD-2026-101129

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP...

CVE-2026-110656

The miniupnpc component (versions through 2.3.3 ) is susceptible to a one-byte heap out-of-bounds read vulnerability. The root cause is located in the minixml parseelt function, where the namespace-prefix handling fails to perform an end-of-buffer check after advancing past a colon (: ) . An atta...