CVE-2026-87875

OpenPrinting CUPS is affected by a heap out-of-bounds read in the cupsUTF32ToUTF8() function (cups/transcode.c). The function lacks a source-length bound, allowing it to read past the end of the source buffer. The flaw is reachable via SNMP supply-description parsing in backend/snmp-supplies.c wi...

CVE-2026-87875

The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content. Mitigation...

GHSA-2J8R-3C22-8565 Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...

GHSA-527H-Q9F6-P7QX Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...

CVE-2026-56711

A flaw was found in VLC media player. An integer overflow vulnerability exists when computing the size of a picture buffer, specifically in the AllocatePicture function. A remote attacker could exploit this by providing a specially crafted Portable Network Graphics PNG image file with large width...

CVE-2026-22590

eProsima Fast DDS (a C++ implementation of the OMG DDS standard) has a remotely triggerable Out-of-Bounds Read in its RTPS DATA_FRAG submessage processing. An attacker can craft a DATA_FRAG with a large sampleSize but a small actual payload, and set fragmentsInSubmessage so the receiver takes the...

CVE-2026-22590 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

CVE-2026-22590 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

EUVD-2026-75058

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

qt: Qt: Denial of Service via out-of-bounds read in text codec handling

A flaw was found in Qt, a popular software development framework. This vulnerability, an out-of-bounds read, occurs in the QTextCodec::codecForName function when it processes specially crafted input that is not properly terminated. An attacker could exploit this to cause the application to select...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

kernel: smb: client: validate DFS referral PathConsumed

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System DFS referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds...

kernel: nvmet-rdma: handle inline data with a nonzero offset

A flaw was found in the nvmet-rdma component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

CVE-2026-87824

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...

DEBIAN-CVE-2026-87824

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...

UBUNTU-CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

CVE-2026-87824

zstd-jni (Java binding for the zstd compression library) versions 1.3.3-1 through 1.5.7-13 contain an out-of-bounds read vulnerability in the Zstd.trainFromBufferDirect method. The root cause is a failure to validate the samples buffer capacity in the native implementation (jni_zdict.c): an attac...