PT-2026-70990

Name of the Vulnerable Software and Affected Versions OriginLab Origin Viewer affected versions not specified Description An issue exists in the parsing of OPJ files due to improper validation of user-supplied data. This can lead to an out-of-bounds write, where data is written past the end of an...

PT-2026-70290

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows affected versions not specified Description An out-of-bounds write in the Ring 2 device drivers allows an unauthenticated network adversary to cause a denial of service. This issue can be...

PT-2026-70811

Name of the Vulnerable Software and Affected Versions Lightroom Classic affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious fil...

PT-2026-70806

Name of the Vulnerable Software and Affected Versions Lightroom Classic affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution in the context of the current user. This occurs when a user opens a malicious file, requiring user...

CVE-2026-11812

The UpdateHub management subsystem subsys/mgmt/updatehub/updatehub.c drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds1. Access to ctx was not serialized, and preparef...

CVE-2026-11812 UpdateHub: race condition on shared context causes out-of-bounds write and DoS

The UpdateHub management subsystem subsys/mgmt/updatehub/updatehub.c drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds1. Access to ctx was not serialized, and preparef...

CVE-2026-11812 UpdateHub: race condition on shared context causes out-of-bounds write and DoS

The UpdateHub management subsystem subsys/mgmt/updatehub/updatehub.c drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds1. Access to ctx was not serialized, and preparef...

CVE-2026-11812

CVE-2026-11812 concerns the UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) where access to a single file-scope ctx structure is not serialized. The code allows two concurrent flows to mutate ctx (background autohandler and user-triggered operations), and prepare_fds() can writ...

CVE-2026-11812 UpdateHub: race condition on shared context causes out-of-bounds write and DoS

The UpdateHub management subsystem subsys/mgmt/updatehub/updatehub.c drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds1. Access to ctx was not serialized, and preparef...

CVE-2026-8718 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-8718

CVE-2026-8718 affects Zephyr net sockets TLS with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID and an established DTLS session. tls_opt_dtls_peer_connection_id_value_get() passes optval to mbedtls_ssl_get_peer_cid() without ensuring the destination buffer is large enough (MBEDTLS_SSL_CID_OUT_LEN_MAX, de...

CVE-2026-8718 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

SUSE-SU-2026:3562-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2026-27951: 32-bit system denial of service via endless blocking loop in StreamEnsureCapacity bsc1258939. - CVE-2026-33952: client denial of service via unvalidated authentication length field bsc1261196. - CVE-2026-33977: client denial of...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2026-64830: heap buffer overflow via VobSub subtitle demuxer bsc1272752. CVE-2026-66039: MACE6 audio decoder heap out-of-bounds write via CAF file bsc1272765. Patch Instructions: To install this SUSE update use the SUSE recommended installati...

SUSE-SU-2026:3552-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer bsc1272752. - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File bsc1272765...

AZL-94842 CVE-2026-68253 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

AZL-95301 CVE-2026-68159 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

UBUNTU-CVE-2026-68365

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

UBUNTU-CVE-2026-68401

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

AZL-94719 CVE-2026-68145 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...