CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-45450

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-110958

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to...

Gomarkdown Markdown Parser and HTML Renderer for Go – Buffer Overflow Vulnerability

The gomarkdown Markdown Parser and HTML Renderer for Go versions prior to 0.0.0-20260724235538-61af6e1e6971 have a buffer error vulnerability. This vulnerability stems from the parser.IsSafeURL function, which slices the URL portion url:nPath before checking the URL length. When dealing with shor...

Netcore NR256CN buffer error vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have a buffer error vulnerability. This vulnerability stems from the Boa web server’s userok function, which does not validate the length of the Basic-auth username. The username is copied into a 64-byte stack buffer using strcpy, allowing...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability arises from checkDataSetAccess, which reverses the source and destination parameters ofStringUtilscopyStringToBuffer when constructing the MMSASSOCIATIONSPECIFIC dataset reference. As a...

R. S. Doiel antiword buffer error vulnerability

R. S. Doiel’s Antiword versions 0.37 and earlier have a buffer error vulnerability. This vulnerability stems from the reverse boundary checking of the count of PlcfLst records in the vGet8LstInfo function in prop8.c. This leads to out-of-buffer reads, allowing attackers to provide a specially...

Red Hat Enterprise Linux numerical error vulnerabilities

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a numerical error vulnerability. This vulnerability stems from an integer overflow that occurs during the calculation of the memory buffer size for image dimensions by the GIMP’s file-pvr plugin. Attackers can exploit this vulnerability by...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a buffer overflow vulnerability. This vulnerability stems from the libparted library’s handling of file system resizing logic for FAT16 volumes. The exploit involves exploiting a heap-based buffer overflow by tricking users or administrators...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a buffer overflow vulnerability. This vulnerability arises from parted’s handling of specially crafted FAT32 file systems. It is caused by integer calculation errors during buffer allocation, leading to a heap-based buffer overflow. Local...

MariaDB Server buffer error vulnerability

MariaDB Server versions from 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.1 to 11.4.13, 11.8.1 to 11.8.9, 12.3.1 to 12.3.3, and 13.0.1 to 13.0.2 have a buffer error vulnerability. This vulnerability arises from STArea, which processes invalid WKBs for MultiPolygon. The polygon parser does not...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from integer rounding errors in the bitmap size calculation within persistentcachereadentryv2, leading to a heap buffer overflow. An attacker can create persistent cache v2 files with excessively large...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the persistentcachereadentryv3 function. An attacker can provide a specially crafted v3 persistent cache file. Setting larger width and height values causes the size...

MariaDB Server buffer error vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a buffer error vulnerability. This vulnerability arises from STAsText, when converting deeply nested GeometryCollections, where recursive...

GStreamer gst-plugins-good buffer error vulnerability

GStreamer’s gst-plugins-good version prior to 1.28.2 has a buffer error vulnerability. This vulnerability stems from the qtdemuxparsechnl function in the isomp4 plugin during MP4 file parsing, which may cause out-of-bounds read access to global arrays, potentially leading to information leakage...

Lenovo Energy Management Driver buffer error vulnerability

Versions of the Lenovo Energy Management Driver prior to 15.11.30.14 contain a buffer error vulnerability. This vulnerability stems from out-of-bounds writes, which may cause blue-screen errors for locally authenticated users...

WEINVEIW EBProv Security Vulnerability

Weinveiw EBProv v.6.10.01.51020251022 has a security vulnerability. This vulnerability stems from a buffer overflow in the UtilityManagerEx.exe component, which could allow a remote attacker to execute arbitrary code...

Latchset LUKSMeta buffer error vulnerability

The LATCHSET LUKSMeta exists buffer error vulnerability stems from luksmeta’s improper boundary verification of metadata slots. Attackers can redirect erasure or loading operations outside the intended metadata area by providing or modifying disk heads. This allows them to overwrite or clear...

Freedesktop spice-server numerical error vulnerability

The Freedesktop spice-server has a numerical error vulnerability. This vulnerability stems from the GLZ encoder dictionary recovery path truncating the sizet allocation size to an int when calling the malloc callback. This could allow authenticated malicious SPICE clients to trigger a large-scale...