cve-2025-5915

CVE-2025-5915 — libarchive RAR v4 heap over-read with on-device iOS 18.5 proof A controlled heap over-read / memory-disclosure in libarchive's RAR v4 filter path copyfromlzsswindow. This repo reproduces it end to end: local ASan, a from-scratch RAR v4 encoder that dials the leak size, and an...

CVE-2026-116544

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544

Open5GS versions 2.6.1 through 2.8.0 are vulnerable to an out-of-bounds read in the parse_scheme_output() function located in lib/sbi/conv.c. The vulnerability is caused by incomplete length validation during SUCI de-concealment. Remote unauthenticated UEs or SBI peers can exploit this by submitt...

EUVD-2026-109914

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

CVE-2026-116544 Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parseschemeoutput in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a hea...

PT-2026-123397

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse scheme output in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a...

Nginx-chain-Rift-Poolslip

nginx PoolSlip × Rift — ASLR-independent RCE chain First public chain of two recently-disclosed nginx rewrite-engine bugs into a single ASLR-independent remotesystem on the stock officialnginx:1.30.0 Docker image Debian 13, glibc 2.41 — no hardcoded addresses, no nginx restart, 90 % per fresh...

Apache RocketMQ Client C++ 2.2.0 (RemotingCommand::Decode) Out-of-Bounds Read

Summary RocketMQ-Client-CPP is the C/C++ client of Apache RocketMQ, a distributed messaging and streaming platform with low latency, high performance and reliability, trillion-level capacity and flexible scalability. Description Apache RocketMQ Client C++ suffers from a remote out-of-bounds read...

Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Summary On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile...

GHSA-9V9V-9QVF-H2HJ Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Summary On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile...

CVE-2026-96644 Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

CVE-2026-96644

The Pillow Python imaging library is vulnerable to a heap over-read on Windows systems prior to version 13.0.0 . The issue occurs because src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. This handler incorrectly sizes a DIB al...

CVE-2026-96644 Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

Rocky Linux 10.2 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_84591)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filenam...

RockyLinux 8 : emacs (RLSA-2026:80506)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the use...

RockyLinux 9 : emacs (RLSA-2026:80507)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80507 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the use...

CLSA-2026-1791337488 php: Fix of 10 CVEs

CVE-2025-14181: fix heap buffer overflow in the SOAP HTTP client chunked response handling GHSA-cj93-vc83-wgqv - CVE-2026-92842: fix heap over-read in convert stream filters with NUL in line-break-chars GHSA-88hq-2827-7pg6 - CVE-2026-93682: fix out-of-bounds read on an empty Location header in...

RLSA-2026:84591 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

emacs security update

An update is available for emacs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNU Emacs is a powerful, customizable, self-documenting text editor. It provid...