CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64271 Input: touchwin - reset the packet index on every complete packet

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

DEBIAN-CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

UBUNTU-CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039 FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039 FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

CVE-2026-66039 FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytesperpacket value. Attackers can craft a CAF file with oversized bytesperpack...

EUVD-2026-48437

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

PT-2026-64415

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2 Description The MACE6 audio decoder contains a signed integer overflow that allows heap memory corruption via a crafted CAF file. By providing oversized bytes per packet and frames per packet values in the desc...

CVE-2026-65604 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

CVE-2026-16768

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palet...

CVE-2026-43820

NIOSSLCertificate.subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1STRING, but not all SANs are backed by ASN1STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This...

CVE-2026-43820

NIOSSLCertificate.subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1STRING, but not all SANs are backed by ASN1STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This...

PYSEC-2026-3496 Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...

PT-2026-64003

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP PKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

The vulnerability of the jq JSON processing tool lies in its failure to handle the elimination of zero bytes or the NUL character, allowing an attacker to trigger a service failure.

The vulnerability of the jq JSON processing tool is related to the lack of measures taken to eliminate the zero byte or NUL character. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2024-55651

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...