394863 matches found
CVE-2026-98184 wifi: mwifiex: prevent authentication frame length truncation
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...
CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...
CVE-2026-98168
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...
CVE-2025-9961
CVE-2025-9961 TP-Link AX10/AX1500 CWMP 缓冲区溢出远程代码执行 概述 CWMP（TR-069）中的栈缓冲区溢出导致远程代码执行。 字段| 值 ---|--- 产品| TP-Link AX10, AX1500 受影响版本| AX10 B"Malicious ACS" B -- C"SetParameterValues" C -- D"Stack Overflow" D -- E"Overwrite PC" E -- F"ret2libc" F -- G"system" G -- H"RCE" 技术细节 漏洞存在于 cwmp 进程处理...
CVE-2025-21333
CVE-2025-21333 Hyper-V NT Kernel Integration VSP（vkrnlintvsp.sys）Paged Pool 堆溢出 → 本地提权（LPE）。 本目录为 lab 用 PoC 源码（基于 MrAle98/CVE-2025-21333-POC，含本机补丁）。 1. 漏洞摘要 项| 内容 ---|--- CVE| CVE-2025-21333 类型| Heap-based Buffer Overflow 影响| 本地提权（EoP）；曾标记野外利用 组件| vkrnlintvsp.sys 漏洞函数|...
CVE-2026-25272
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation...
CVE-2026-25269
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size...
CVE-2026-25270
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...
CVE-2026-25274
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
CVE-2026-105778
A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...
EUVD-2026-92987
A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...
OPENSUSE-SU-2026:22023-1 Security update for chromium
This update for chromium fixes the following issues: Changes in chromium: - Chromium 154.0.8037.97 boo1284015 CVE-2026-103628: Out of bounds write in WebGL CVE-2026-103626: Incorrect authorization in FileSystem CVE-2026-103621: Integer overflow in Compositing CVE-2026-103630: Use after free in...
CVE20264893poc
拓扑： https://medium.com/@yanyuyingshu/reproduction-journal-dnsmasq-ecs-validation-and-buffer-overflow-flaws-e0fe0f66f60c 步骤 1.vi /etc/dnsmasq.conf port=5353 listen-address=xxx.xxx.xxx.x bind-interfaces no-resolv no-hosts no-poll cache-size=1000 log-queries log-facility=- server=127.0.0.15354...
CVE-2026-48095
CVE-2026-48095 7-Zip 是一款高压缩比的文件归档工具。26.00 及更早版本存在一个由 NTFS 压缩流缓冲区分配不足（GetCuSize 移位未定义行为）导致的堆缓冲区溢出漏洞，可能允许攻击者执行任意代码或导致应用程序崩溃。 NTFS 处理器中的 CInStream::GetCuSize 将压缩单元缓冲区大小计算为 UInt321 = 28 且 CompressionUnit == 4，则会使得指数变为 32，这属于未定义行为，在 x86/x64 上会崩溃，导致 inBuf 被分配为 1 字节。随后 ReadStreamFALSE 会以 64 KB 的迭代次数将高达...
EUVD-2026-92983
Memory Corruption when executing system service routines due to improper handling of user input buffers...
CVE-2026-57546 Buffer Over-read in WLAN HAL
Transient DOS when processing a continuous receive command with a zero-sized global configuration override...
CVE-2026-57546 Buffer Over-read in WLAN HAL
Transient DOS when processing a continuous receive command with a zero-sized global configuration override...
CVE-2026-57546
A Buffer Over-read vulnerability exists in the WLAN HAL component. The flaw occurs during the processing of a continuous receive command when a zero-sized global configuration override is present, leading to a transient Denial of Service (DoS) . No specific software versions or remediation steps ...