lwip-snmpv3-stack-overflow-cve-2026-8836-critical-embedded-rce

CVE-2026-8836 — lwIP SNMPv3 栈溢出 PoC 针对 CVE-2026-8836 的概念验证漏洞利用，该漏洞是 lwIP 的 SNMPv3 USM 处理器中存在的一个严重栈缓冲区溢出。 漏洞信息 CVE ：CVE-2026-8836 CVSS ：9.8 严重（Critical） 组件 ：src/apps/snmp/snmpmsg.c 中的 snmpparseinboundframe 根本原因 ：snmpasn1decraw 中边界检查被注释掉，并且缓冲区大小参数错误 缓冲区...

Oracle Linux 9 : gstreamer1-plugins-base (ELSA-2026-69100)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69100 advisory. - Fix CVE-2026-18297: opusdec channel position bounds check Resolves: RHEL-246587 - Fix crash in RTSP auth credential parsing CVE-2026-85150 Resolves:...

EUVD-2026-84029

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

CVE-2026-31694-POC

CVE-2026-31694: FUSE readdir 缓存越界写入 fs/fuse/readdir.c:fuseadddirenttocache 中缺少边界检查。一个 FUSE 服务器返回一个 namelen = 4095 的目录项，序列化后为 4120 字节的记录。内核将其复制到一个 4096 字节的页缓存页中，并溢出 24 个服务器可控字节到下一个物理页。 本仓库包含一个用于写入原型的标记 PoC，以及一个本地提权利用，该利用将溢出整理到 /etc/passwd 的页缓存副本上，并将 root 账户改为无密码账户。 受影响：Linux 6.15+（FUSENAMEMAX 提升到...

CVE-2026-11105-Stack-Buffer-Overflow-in-Custom-Base64-Decoder

CVE-2026-11105 – Desbordamiento de búfer en la pila en el decodificador Base64 personalizado Código del programa C root@kitploit: // base64vuln.c - Vulnerable Base64 decoder include include include int base64decodeconst char in, sizet inlen, char out, sizet outlen static const char table =...

spectre-attack-example

Spectre 攻击例程 2018年1月2日 CVE-2017-5753 和 CVE-2017-5715 "幽灵" Spectre 漏洞利用例子 这是什么？ 我们把文本 "The Magic Words are Squeamish Ossifrage." 放在内存中, 然后我们试图利用漏洞读取他。如果系统易受到攻击, 那么你将在标准输出中看到相同的文本。 在本代码中, 如果 victimfunction 中的编译指令以严格的程序顺序执行, 则该函数只从 array1 0.. 15 中读取, 因为 array1 size = 16。但是, 执行时间超出读取时间是可能的。读取内存 byte...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment 评估系统是否存在以下“推测执行”漏洞： CVE-2017-5715（分支目标注入） CVE-2017-5753（边界检查绕过） CVE-2017-5754（恶意数据缓存加载） 警告：请确保在生成选项中未勾选“Prefer 32-bit”（首选 32 位）。 需要提升的权限 缓解措施需要： 1. 设置注册表值，表明防病毒/安全产品与 Windows 更新兼容 2. 安装 Windows 操作系统更新（属于 2018 年 1 月安全月度质量汇总的一部分） 3. 启用注册表设置 4. 更新硬件/固件 5...

Linux Distros Unpatched Vulnerability : CVE-2026-93178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS- parsed tables are used to index into voltage lookup...

AZL-102029 CVE-2026-93178 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

CVE-2026-93178

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

CVE-2026-93046

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

EUVD-2026-82286

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

CVE-2026-93177 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

EUVD-2026-82285

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93046

CVE-2026-93046 affects the Linux kernel software node subsystem. The bounds check in software_node_get_reference_args() failed when the index was UINT_MAX (i.e., −1 cast to unsigned), causing an out-of-bounds access in the property array. The fix corrects the bound check to cover the UINT_MAX cas...

gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...

DEBIAN-CVE-2026-89825

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...

CVE-2026-89825

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...

DEBIAN-CVE-2026-89826

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...

EUVD-2026-80554

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...