Pillow buffer error vulnerability

Versions of Pillow prior to 13.0.0 have a buffer error vulnerability. This vulnerability stems from the JPEG decoder not verifying the actual output width and number of components of libjpeg after requesting scaling. As a result, full-width scanning lines are written into the buffer allocated for...

Mzanzi Open Source Solutions Schroedinger buffer error vulnerability

Mzanzi Open Source Solutions’ schroedinger 1.0.11 and earlier versions contain a buffer error vulnerability. This vulnerability arises from the lack of validation for wavelet filter indices or transformation depth values, which may lead to out-of-bounds reading of static quantization tables...

libLAS buffer error vulnerability

LibLAS versions 1.8.1 and earlier have a buffer error vulnerability. This vulnerability arises from the point record reader truncating the schema byte size to 16 bits when calculating the point buffer size. An attacker can create a .las file with a schema exceeding 65,535 bytes, resulting in...

Lode Vandevenne has a buffer error vulnerability

Lode Vandevenne’s lodepng 20261006 and earlier versions have a buffer error vulnerability. This vulnerability stems from the lodepng::getFilterTypesInterlaced function in lodepngutil.cpp, which fails to perform boundary checks on the decompressed IDAT data. As a result, a stack overflow attack is...

MariaDB Server buffer error vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a buffer error vulnerability. This vulnerability arises from STAsText, when converting deeply nested GeometryCollections, where recursive...

MariaDB Server buffer error vulnerability

MariaDB Server versions from 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.1 to 11.4.13, 11.8.1 to 11.8.9, 12.3.1 to 12.3.3, and 13.0.1 to 13.0.2 have a buffer error vulnerability. This vulnerability arises from STArea, which processes invalid WKBs for MultiPolygon. The polygon parser does not...

Konstanty Bialkowski libmodplug buffer error vulnerability

Konstanty Bialkowski’s libmodplug versions 0.8.9.1 and earlier have a buffer error vulnerability. This vulnerability stems from the fact that the nPat parameter in the CSoundFile::ReadDSM function is not validated against MAXPATTERNS. Attackers can exploit this vulnerability by providing a...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-74495

CVE-2026-74495 affects the Linux kernel igbvf driver. The issue is a leak in TX DMA error cleanup: when mapping TX buffers, buffers already mapped for a skb must be unmapped. The root cause is an off-by-one error from decrementing the count before the dma_error loop, after the count had been incr...

CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

CVE-2026-6390

CVE-2026-6390 affects GNU nano. The issue is a format string vulnerability in multi-buffer error handling: when opening multiple files at startup, a filename containing printf format specifiers can be reinterpreted, potentially enabling stack information disclosure, a crash (DoS), or arbitrary me...

CVE-2026-6390: Use of Externally-Controlled Format String

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...

CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent...

PYSEC-2026-1056 Potential double free of buffer during string decoding

Impact What kind of vulnerability is it? Who is impacted? When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. Patches Has the problem been patche...

EUVD-2026-41787

The MAX32xxx USB device controller driver drivers/usb/udc/udcmax32.c, compatible adimax32usbhs dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udceventxferoutdone called netbufaddbuf, eprequest-actlen immediately after buf =...

SUSE-SU-2026:2749-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer bsc1267957. - CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow bsc1267849...

Alibaba Cloud Linux 3 : 0168: libpng12 (ALINUX3-SA-2026:0168)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0168 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for u...

CVE-2026-53009

In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of txbuf skb If icetso or icetxcsum fail, the error path in icexmitframering frees the skb, but the 'first' txbuf still points to it and is marked as valid ICETXBUFSKB. 'nexttouse' remains unchanged, so the...

SUSE-SU-2026:22330-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer bsc1267957. - CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow bsc1267849...

SUSE-SU-2026:22257-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer bsc1267957. - CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow bsc1267849...