CVE-2026-32945

CVE-2026-32945 PJSIP DNS 압축 포인터 힙 OOB 읽기 원격 DoS 설명 pjlib-util/src/pjlib-util/dns.c의 getnamelen 및 getname 함수는 두 바이트가 모두 패킷 버퍼 내에 있는지 확인하지 않고 pjmemcpy&offset, p, 2를 통해 2바이트 DNS 압축 포인터를 읽습니다. 0xC0 바이트압축 포인터 마커가 DNS 응답의 맨 마지막 바이트인 경우, memcpy는 힙 할당 경계를 1바이트 초과하여 읽습니다. 단일 20바이트로 조작된 DNS 응답은 OOB 읽기를 유발하...

UBUNTU-CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

CVE-2026-104201

GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption...

Linux Distros Unpatched Vulnerability : CVE-2026-104201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - radsecproxy - None Ubuntu Linux - GHSA-wj29-mxmc-q98c: Heap OOB read/write in MS-MPPE key re-encryption CVE-2026-104201 Note that Nessus relies o...

Rocky Linux 9 [CIQ] Security Update: dnsmasq / dnsmasq-debuginfo / dnsmasq-debugsource / dnsmasq-utils / etc Multiple Vulnerabilities (crlsa-2026_19373)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619373 advisory. dnsmasq: dnsmasq: heap buffer overflow in cache via NAMEESCAPE expansion CVE-2026-2291 dnsmasq: NSEC bitmap parsing infinite loop CVE-2026-4890 dnsmasq:...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

EUVD-2026-89174

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

The ThreadX loadable-module loader contains two issues triggered when a device loads an attacker-controlled module via the _txm_module_manager_memory_load or _txm_module_manager_in_place_load APIs. Because these APIs accept only a base pointer without an image length, fields in TXM_MODULE_PREAMBL...

CVE-2026-81884

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81882

The reverse engineering framework radare2 (prior to version 6.2.0 ) is vulnerable to an out-of-bounds read within its binary property-list Unicode parser. The parser fails to guarantee NUL termination and underallocates an uninitialized UTF-8 destination. When a local attacker executes the pFB or...

EUVD-2026-84468

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81881

The reverse engineering framework radare2 contains a heap out-of-bounds read vulnerability in its Mach-O Swift field-metadata parser (versions prior to 6.2.0 ). The issue arises because a relative Swift field pointer can be lower than the field-metadata section base, resulting in a negative logic...

SUSE CVE-2026-93179

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

Important: Red Hat Security Advisory: rust security update

An update for rust is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2026-84448

libheif , a HEIF and AVIF file format decoder/encoder, contains a heap out-of-bounds read in its region writer API prior to version 1.23.2 . The function heif_region_item_add_region_inline_mask_data() in heif_regions.cc accepts a mask_data_len parameter without verifying it matches the byte count...

CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

Linux Distros Unpatched Vulnerability : CVE-2026-93179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the curso...

Linux Distros Unpatched Vulnerability : CVE-2026-90230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH- HMAC-CHAP message buffer with the host-supplied transfer length ...