CVE-2026-111105

The rlottie library used in Telegram is vulnerable to a Remote Code Execution (RCE) flaw caused by a numeric truncation error (CWE-197) . Due to insufficient validation of user-supplied data, the flaw can lead to a write before the start of an allocated buffer . A remote attacker can exploit this...

CVE-2026-111105 Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-55246

The bincookie header-only binarycookies parser is vulnerable to a heap buffer overflow and out-of-bounds write in versions prior to 0.1.9 . The root cause lies in the bincookie_init_file() function within bincookie.h, which uses the file-controlled num_pages field as a loop bound for byte-swappin...

CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-45450

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-110958

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to...

Gomarkdown Markdown Parser and HTML Renderer for Go – Buffer Overflow Vulnerability

The gomarkdown Markdown Parser and HTML Renderer for Go versions prior to 0.0.0-20260724235538-61af6e1e6971 have a buffer error vulnerability. This vulnerability stems from the parser.IsSafeURL function, which slices the URL portion url:nPath before checking the URL length. When dealing with shor...

Netcore NR256CN buffer error vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have a buffer error vulnerability. This vulnerability stems from the Boa web server’s userok function, which does not validate the length of the Basic-auth username. The username is copied into a 64-byte stack buffer using strcpy, allowing...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability arises from checkDataSetAccess, which reverses the source and destination parameters ofStringUtilscopyStringToBuffer when constructing the MMSASSOCIATIONSPECIFIC dataset reference. As a...

R. S. Doiel antiword buffer error vulnerability

R. S. Doiel’s Antiword versions 0.37 and earlier have a buffer error vulnerability. This vulnerability stems from the reverse boundary checking of the count of PlcfLst records in the vGet8LstInfo function in prop8.c. This leads to out-of-buffer reads, allowing attackers to provide a specially...

Red Hat Enterprise Linux numerical error vulnerabilities

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a numerical error vulnerability. This vulnerability stems from an integer overflow that occurs during the calculation of the memory buffer size for image dimensions by the GIMP’s file-pvr plugin. Attackers can exploit this vulnerability by...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a buffer overflow vulnerability. This vulnerability arises from parted’s handling of specially crafted FAT32 file systems. It is caused by integer calculation errors during buffer allocation, leading to a heap-based buffer overflow. Local...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a buffer overflow vulnerability. This vulnerability stems from the libparted library’s handling of file system resizing logic for FAT16 volumes. The exploit involves exploiting a heap-based buffer overflow by tricking users or administrators...

MariaDB Server buffer error vulnerability

MariaDB Server versions from 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.1 to 11.4.13, 11.8.1 to 11.8.9, 12.3.1 to 12.3.3, and 13.0.1 to 13.0.2 have a buffer error vulnerability. This vulnerability arises from STArea, which processes invalid WKBs for MultiPolygon. The polygon parser does not...

Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from integer rounding errors in the bitmap size calculation within persistentcachereadentryv2, leading to a heap buffer overflow. An attacker can create persistent cache v2 files with excessively large...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the persistentcachereadentryv3 function. An attacker can provide a specially crafted v3 persistent cache file. Setting larger width and height values causes the size...

MariaDB Server buffer error vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a buffer error vulnerability. This vulnerability arises from STAsText, when converting deeply nested GeometryCollections, where recursive...