CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV 힙 OOB 쓰기 PoC !WARNING 이 저장소는 힙 손상 취약점에 대한 작동하는 익스플로잇 PoC를 포함하고 있습니다. 이는 승인된 보안 연구, CTF 상황, 방어적 분석 목적으로만 사용됩니다. 자신이 소유하지 않거나 명시적 서면 허가를 받지 않은 시스템에 대해 사용하지 마십시오. 영향: FFmpeg 8.0.1 MagicYUV 디코더 libavcodec/magicyuv.c 원시: 힙 OOB 쓰기 → AVBuffer.free 하이잭 → syste...

CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

CVE-2026-31431

CVE-2026-31431 — NULL 포인터에서 루트 권한까지: Linux 커널의 AFALG AEAD 익스플로잇 버그 클래스: NULL 포인터 역참조 → 힙 OOB 쓰기 → 자격 증명cred 덮어쓰기 영향받는 서브시스템: net/alg/afalg.c 영향: 로컬 권한 상승비특권 사용자 → root 영향받는 커널: Linux 4.4 – 4.9패치 전 요약 커널이 사용자 공간 주소를 기대하는 위치에 NULL 포인터를 전달하면서 setsockopt를 호출합니다. 커널은 주소 0x00000000에서 읽어옵니다. 그리고 제로 페이지를...

CVE-2026-32945

CVE-2026-32945 PJSIP DNS 압축 포인터 힙 OOB 읽기 원격 DoS 설명 pjlib-util/src/pjlib-util/dns.c의 getnamelen 및 getname 함수는 두 바이트가 모두 패킷 버퍼 내에 있는지 확인하지 않고 pjmemcpy&offset, p, 2를 통해 2바이트 DNS 압축 포인터를 읽습니다. 0xC0 바이트압축 포인터 마커가 DNS 응답의 맨 마지막 바이트인 경우, memcpy는 힙 할당 경계를 1바이트 초과하여 읽습니다. 단일 20바이트로 조작된 DNS 응답은 OOB 읽기를 유발하...

Rocky Linux 9 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-debugsource / grub2-efi-aa64 / etc (crlsa-2025_20532)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202520532 advisory. grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write. CVE-2024-45777 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.2 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778756042)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778756042 advisory. - OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

EUVD-2026-89174

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

The ThreadX loadable-module loader contains two issues triggered when a device loads an attacker-controlled module via the _txm_module_manager_memory_load or _txm_module_manager_in_place_load APIs. Because these APIs accept only a base pointer without an image length, fields in TXM_MODULE_PREAMBL...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32비트 익스플로잇 랩 이 저장소는 nginx 1.30.0에서 CVE-2026-42945를 연구하기 위한 재현 가능한 Docker 실험실입니다. 취약한 32비트 타겟, 기본 트리거, 연구실 지원known-address RCE 검증기, 그리고 내부 조사introspection 없이 작동하는 브루트포스 드라이버를 포함합니다. 증명 경계는 다음과 같습니다: exploit/triggeroob.py는 힙 OOB 쓰기 프리미티브를 시연합니다. exploit/labknownaddress.py는 Dock...

CVE-2026-81884

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81882

The reverse engineering framework radare2 (prior to version 6.2.0 ) is vulnerable to an out-of-bounds read within its binary property-list Unicode parser. The parser fails to guarantee NUL termination and underallocates an uninitialized UTF-8 destination. When a local attacker executes the pFB or...

EUVD-2026-84468

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81881

The reverse engineering framework radare2 contains a heap out-of-bounds read vulnerability in its Mach-O Swift field-metadata parser (versions prior to 6.2.0 ). The issue arises because a relative Swift field pointer can be lower than the field-metadata section base, resulting in a negative logic...

Important: Red Hat Security Advisory: rust security update

An update for rust is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Linux Distros Unpatched Vulnerability : CVE-2026-63638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, a...

CVE-2026-92382

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

Linux Distros Unpatched Vulnerability : CVE-2026-63419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, a...