HeapCrypt

HeapCrypt Encypting the Heap while sleeping by hooking and modifying Sleep with our own function that encrypts the heap , sleeps for a moment then decrypts the heap : 16bit key xor heap encryption : 16bit key xor heap decryption : References : https://www.arashparsa.com/hook-heaps-and-live-free/...

CVE-2026-63449

Suricata versions 8.0.0 through 8.0.6 are affected by a SIP parser flaw in rust/src/sip/parser.rs, where request and response body lengths are stored in 16-bit fields . A SIP body exceeding 65,536 bytes truncates the stored length, causing frame:request.body or frame:response.body to omit part of...

DiagSpill

DiagSpill CVE-2026-74469 分析文章 !WARNING 本 PoC 仅用于帮助防御者、维护者和经授权的安全团队验证其拥有或明确获授权测试的系统上的补丁、缓解措施、检测规则和暴露情况。 您需自行负责确保对本材料的使用是合法、经授权、受控的，并在隔离的测试环境中进行。 !WARNING 本 PoC 具有破坏性。 它会覆写约 8 MiB 的内核内存，并使 diagspillhold 牺牲内存持有者所持有的已损坏页表一直保留到重启。终止该进程可能导致内核不稳定。 无关内存可能被破坏，机器可能发生 panic。请仅在一次性虚拟机/一次性主机上运行。 该 PoC： 1. 编译内...

Linux Distros Unpatched Vulnerability : CVE-2026-90245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsign...

EUVD-2026-81838

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

CVE-2026-19667

A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid...

CVE-2026-19667

CVE-2026-19667 is a remote assertion failure in the BIND 9 named daemon, caused by a 16-bit length truncation in dns_ncache_add(). When an attacker-controlled authoritative server returns a negative answer of exactly 65536 bytes , the negative cache entry is stored as 0 bytes; reading that entry ...

CVE-2025-65018_Exploit_Challenge

CVE-2025-65018 CTF Challenge: "PNG Panic" This challenge is based on a real-world buffer overflow vulnerability in libpng specifically dealing with the simplified API pngimagefinishread when handling 16-bit interlaced images. 🚩 Challenge Goal You are provided with a vulnerable binary victim that...

Astra Linux – Vulnerability in libstb

A issue was discovered in stbstbimage.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting them to RGBA format. This led to a buffer overflow when the result was re-interpreted as a 16-bit buffer. An attacker could potentially use stbimage to crash a service, o...

CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

UBUNTU-CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-80978

CVE-2026-80978 affects the Linux kernel networking subsystem, specifically the IP tunnel devices. When a local attacker stacks user-created IP tunnel devices, the derived needed_headroom can exceed the 16-bit skb header offset range, causing those offsets to wrap during skb head expansion. The fi...

EUVD-2026-76301

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

PT-2026-90108

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

PT-2026-85717

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct sk buff are 16-bit offsets from skb-head, and U16 MAX is reserved as the unset transport header value. batadv tvlv call...

EUVD-2026-68964

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 lib/ash/vector.ex encodes a vector as followed by the element floats, packing the element...

EEF-CVE-2026-82737 Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Summary Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 lib/ash/vector.ex encodes a vector as followed by the element floats, packing the...

CVE-2026-55894

A flaw was found in Capstone, a disassembly framework. The shdisassemble function incorrectly processes 16-bit instructions, leading to an attempt to read data from an unauthorized memory location an out-of-bounds read. A remote attacker could exploit this by providing specially crafted bytecode ...

PT-2026-69677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Out-of-bounds reads occur in three sideband reply parsers when reading 16-bit fields. The issue arises because bounds are checked only after the read operation. Specifically, when the...

CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12...