EUVD-2026-115211

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005cinit that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more...

CVE-2026-120451 libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005cinit that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more...

CVE-2026-120451 libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005cinit that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more...

CVE-2026-120451

Versions of libgphoto2 through 2.5.34 are vulnerable to stack-based and heap-based buffer overflows within the jl2005c_init() function of the jl2005c camera driver. The root cause is the handling of an unbounded allocation table entry count from USB devices. A malicious actor can connect a spoofe...

CVE-2026-120439 QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort

QuickJS-NG before 0.16.0 contains an integer overflow in jstypedarraysort in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the...

CVE-2026-120439 QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort

QuickJS-NG before 0.16.0 contains an integer overflow in jstypedarraysort in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the...

CVE-2026-120438 QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

CVE-2026-120438 QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

EUVD-2026-115198

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

CVE-2026-120438

The QuickJS-NG JavaScript engine (versions before 0.16.0 ) is vulnerable to a heap buffer overflow on 32-bit hosts due to an integer overflow in the js_proxy_get_own_property_names() function within quickjs.c. An attacker running JavaScript can trigger this by returning a large array-like object ...

CVE-2026-120436

The Netpbm image processing library (versions before 10.86.51 , 11.x before 11.02.30 , and 11.03 before 11.15.08 ) is vulnerable to a heap buffer overflow within the jbigtopnm component. The root cause is an integer overflow occurring during the calculation of the output buffer size. An attacker ...

CVE-2026-120436 Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes overflows th...

EUVD-2026-115196

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes overflows th...

CVE-2026-120436 Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes overflows th...

CVE-2026-120435 Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

EUVD-2026-115195

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

CVE-2026-120435

The Netpbm image processing library contains a heap buffer overflow in the xpmtoppm component. The vulnerability is caused by an unvalidated characters-per-pixel value in the XPM header; an attacker can supply a crafted XPM file with a value greater than 3 to overrun fixed 3-byte colorName hash e...

CVE-2026-120434 Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack arr...

EUVD-2026-115194

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack arr...

CVE-2026-120434

The Netpbm software (versions before 10.86.51 , 11.x before 11.02.30 , and 11.03 before 11.15.08 ) is vulnerable to a stack-based buffer overflow in the scanPoly() function within converter/ppm/picttoppm.c. An attacker can provide a crafted PICT file where polygon edges generate more than 5000 po...