116 matches found
EUVD-2026-38004
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decodemove function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by...
CVE-2026-56132
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...
SUSE CVE-2026-46191
In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the font buffer if the reallocation during console rotation fails in fbconrotatefont. The putcs implementations for the rotated buffer will return early in this case. S...
CVE-2026-46191
CVE-2026-46191 concerns the Linux kernel fbcon component: when console rotation fails during fbcon_rotate_font(), the font buffer may overflow due to an OOB access. The fix clears the font buffer if the reallocation during console rotation fails and ensures the rotated buffer does not overflow. D...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: Issue: Skipping the reallocation of the Unicode buffer when resizing the alternate screen after exiting the alt-screen mode. When the enteraltscreen function saves vcunilines into vcsavedunilines and sets vcunilines to NULL, a...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: Ice: Fixed DMA mapping leaks The leak was fixed when the user changed ring parameters. During the reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with a different RX ring count should...
JLSEC-2026-380
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation...
CLSA-2026-1773928447 expat: Fix of CVE-2026-25210
CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent function...
EUVD-2026-17233
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...
CLSA-2026-1774283473 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: Improve determination of buffer size bufSize in function doContent - debian/patches/CVE-2026-25210.patch: fix integer overflow in doContent tag buffer reallocation - CVE-2026-25210...
CLSA-2026-1774021165 expat: Fix of CVE-2026-25210
CVE-2026-25210: fix memory corruption via integer overflow in doContent function during tag buffer reallocation...
expat: Fix of CVE-2026-25210
CVE-2026-25210: fix memory corruption via integer overflow in doContent function during tag buffer reallocation...
CLSA-2026-1773925534 expat: Fix of CVE-2026-25210
Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation...
CLSA-2026-1774009875 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: integer overflow in doContent tag buffer reallocation. - debian/patches/CVE-2026-25210.patch: add overflow check for tag buffer reallocation - CVE-2026-25210...
CLSA-2026-1774006814 expat: Fix of CVE-2026-25210
CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent...
CLSA-2026-1773930717 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: integer overflow in doContent tag buffer reallocation. - debian/patches/CVE-2026-25210.patch: add overflow check for tag buffer reallocation - CVE-2026-25210...
CLSA-2026-1773930526 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: integer overflow in doContent tag buffer reallocation. - debian/patches/CVE-2026-25210.patch: add overflow check for tag buffer reallocation - CVE-2026-25210...
CLSA-2026-1773928179 expat: Fix of CVE-2026-25210
Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation...