CVE-2026-59959

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame...

CVE-2026-59959

The SAIL cross-platform image library (prior to version 1.0.2 ) contains a vulnerability in its built-in WebP decoder . When processing a malformed animated WebP file with inconsistent container or ANMF frame metadata, the function sail_codec_load_init_v8_webp() in src/sail-codecs/webp/webp.c can...

TencentOS Server 3: firefox (TSSA-2026:1215)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1215 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Codecs Component DoS

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted video file...

Codecs Component Protected Information Access

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to errors in variable initialization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Codecs Component DoS

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to a buffer overflow in memory. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Codecs Component Protected Information Access

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to the use of an uninitialized resource. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Codecs Component DoS

The vulnerability in the Codecs component of Google Chrome and Microsoft Edge web browsers is related to a buffer overflow in memory. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-98743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may...

CVE-2026-98743

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

Microsoft Windows HEVC Video Extensions from Device Manufacturer < 2.4.86.0 / 2.5.25.0 RCE (October 2026)

The Windows 'HEVC Video Extensions from Device Manufacturer' app installed on the remote host is prior to 2.4.86.0 2.5.25.0 on Windows 11 versions 25H2 and 26H1. It is, therefore, affected by a remote code execution vulnerability. Integer overflow or wraparound in Microsoft Windows Codecs Library...

Microsoft Windows HEVC Video Extensions for Licensed Applications < 2.4.85.0 RCE (October 2026)

The Windows 'HEVC Video Extensions for Licensed Applications' app installed on the remote host is prior to 2.4.85.0. It is, therefore, affected by a remote code execution vulnerability. Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute...

Microsoft Windows HEVC Video Extensions < 2.4.87.0 RCE (October 2026)

The Windows 'HEVC Video Extensions' app installed on the remote host is prior to 2.4.87.0. It is, therefore, affected by a remote code execution vulnerability. Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network...

Astra Linux – vulnerability in Chromium

In Google Chrome on Linux and ChromeOS prior to version 149.0.7827.103, uninitialized use of certain codecs allowed a remote attacker to leak cross-origin data via a specially crafted video file. Chromium security severity: High...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: Fix leaking content of localcodecs The following memory leak can be observed when the controller supports codecs which are stored in localcodecs list but the elements are never freed: unreferenced object...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix missing mbhc init error handling MBHC initialization can fail; therefore, add the missing error handling to prevent dereferencing an error pointer during subsequent jack configuration: Unable to handle...

Astra Linux – vulnerability in Chromium

Out-of-bounds writes in the Codecs feature in Google Chrome prior to version 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 150.0.7871.115, read and write access in Codecs using Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In hci, fix for null-ptr-deref in hcireadsupportedcodecs. Fix hcicmdsyncsk to return not NULL for unknown opcodes. hcicmdsyncsk returns NULL if a command returns a status event. However, it also returns NULL where a...

Astra Linux – vulnerability in Chromium

The “Use after free” vulnerability in Google Chrome’s Codecs before version 149.0.7827.53 allowed a remote attacker to retrieve potentially sensitive information from process memory via a specially crafted HTML page. Chromium security severity: Medium...