CVE-2026-81508 ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btca2dpsinkhandleincmedia reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio...

CVE-2025-14857-MongoBleed

CVE-2025-14847 MongoBleed - 動作するPoC MongoDBメモリリークの悪用 - シミュレートされたR6攻撃 CVE-2025-14847 MongoBleed の完全な概念実証 テスト済み: ✅ MongoDB 7.0.5 | 14,300+ 件のエクスプロイト成功 | 4 件のUUIDリーク 🎯 プロジェクトについて このリポジトリには、CVE-2025-14847 （MongoBleed として知られる）に対する完全に機能する概念実証（PoC）が含まれています。これは、MongoDBにおける認証前のヒープメモリ情報漏えいという重大な欠陥です。 背景:...

mongobleed

mongobleed CVE-2025-14847 は、MongoDB の OPCOMPRESSED バッファの過剰読み取りを利用したヒープメモリ開示エクスプロイトです。 使用法 root@kitploit: $ bundle exec ruby mongobleed.rb --help Usage: mongobleed.rb options --host HOST Target host default: localhost --port PORT Target port default: 27017 --min-offset MIN Min doc length default: ...

thunderbird: Information disclosure due to malicious IMAP server response

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js...

CVE-2025-14847-mongobleed

CVE-2025-14847-mongobleed CVE-2025-14847 mongobleed python ファイル CVE-2025-14847 CVE-2025-14847 https://jira.mongodb.org/browse/SERVER-115508 概要 これは、CVE-2025-14847 に対処するための重要な修正です。8.2.3、8.0.17、7.0.28、6.0.27、5.0.32、または 4.4.30 にアップグレードしてください。 問題の説明と影響 サーバーの zlib...

CVE-2025-14847

CVE-2025-14847 MongoBleed 📜 説明 このスクリプトは、MongoDB Server における ヒープメモリ開示脆弱性 （CVE-2025-14847 、"MongoBleed"）を悪用するために設計されています。 細工された zlib 圧縮 OPMSG パケットを、誇張されたドキュメント長で送信することで、サーバーに未初期化のヒープメモリを応答に返させるように仕向けます。これにより、以下のような機密情報が漏洩する可能性があります。 スクリプトは様々なオフセットでプローブを連続的に送信し、新たに観測された漏洩文字列...

CVE-2026-91963

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...

DEBIAN-CVE-2026-91963

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

CVE-2026-91963

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

CVE-2026-91946

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function...

PT-2026-92082

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

DEBIAN-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

PT-2026-89741

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-22590

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

CVE-2026-22590

eProsima Fast DDS (a C++ implementation of the OMG DDS standard) has a remotely triggerable Out-of-Bounds Read in its RTPS DATA_FRAG submessage processing. An attacker can craft a DATA_FRAG with a large sampleSize but a small actual payload, and set fragmentsInSubmessage so the receiver takes the...

CVE-2026-22590 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

CVE-2026-22590 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

OPENSUSE-SU-2026:21748-1 Security update for sssd

This update for sssd fixes the following issues: Security issues fixed: - CVE-2026-68742: insufficient validation in the NSS responder can lead to an out-of-bounds read and a process crash when a crafted GETHOSTBYADDR request is sent to the NSS responder socket bsc1273922. - CVE-2026-68743:...

SUSE CVE-2026-84641

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

Linux Distros Unpatched Vulnerability : CVE-2026-84641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to...