Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write through the Snappy.uncompressArray methods. An attacker can corrupt heap memory and potentially cause application crashes or unexpected behavior by supplying specially crafted compressed input that results in...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the Snappy.compress function. An attacker can cause memory corruption and force the Java Virtual Machine to terminate by providing incompressible data that exceeds the remaining capacity of the destination buffer...

SUSE CVE-2026-73066

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count,...

SUSE CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

SUSE CVE-2026-90068

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

SUSE CVE-2026-90090

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

SUSE CVE-2026-90419

In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent out-of-bounds read in super root block parsing super-root inode metadata size is trusted before nilfsreadinodecommon. Reject super-root inode sizes whose computed on-disk footprint exceeds the filesystem block siz...

SUSE CVE-2026-93148

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-63419: Out-of-bounds Write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel...

CVE-2026-61714: Heap-based Buffer Overflow

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

CVE-2026-73863: Out-of-bounds Read

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-16514: Out-of-bounds Read

gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...

CVE-2026-63420: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channelbuffers than the spec.nchannels value advertised ...

CVE-2026-75892: Out-of-bounds Write

In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtpdecodepdpctx function through the PDP context GSN-Address sub-field, leading to memory corruption...

CVE-2026-11726: Out-of-bounds Read

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values...

ROS-20260918-73-0036

The vulnerability of the smb2getea function in the fs/smb/server/smb2pdu.c file of the Smb kernel of the Linux operating system is related to memory writing beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality,...

ROS-20260918-73-0038

The vulnerability in the net/rxrpc/key.c module of the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-63638: Out-of-bounds Write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

The vulnerability of the fromVirtualSer() function in Tenda F453 router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the fromVirtualSer function in Tenda F453 router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Linux Kernel Out-of-Bounds Write Vulnerability

Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted products could be end-of-life EoL and/or...