CVE-2026-55191 FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

CVE-2026-55191

FreeRDP clients prior to 3.27.0 are vulnerable to a heap-buffer-overflow write in the RDPGFX AVC444 codec path. In libfreerdp/codec/h264.c, the function avc444_ensure_buffer() computes the intermediate YUV444 buffer size using 32-bit multiplication (piDstStride[x] * padDstHeight). A malicious RDP...

CVE-2026-75143

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75144

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75141

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers...

CVE-2026-70628

A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV Windows Recorded TV Show file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence ...

CVE-2026-75144 FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75144

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

EUVD-2026-62581

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75144

CVE-2026-75144 is a heap buffer overflow in FFmpeg 's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c). The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, allowing memory corruption when a crafted Dirac data unit is packe...

CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

EUVD-2026-62580

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75143

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75143

FFmpeg (versions 4.4 through 9.0 , built with --enable-librist) contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). The function librist_read() ignored its size argument, copying the full received RIST payload into the caller's buffer. When accessed via the async:...

CVE-2026-75141

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers...

EUVD-2026-62578

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers...

MINI-V8G4-5VGQ-88RR

Bulletin has no description...

CVE-2026-16814

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow...

CVE-2026-16814 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow...

CVE-2026-16814

CVE-2026-16814 is a heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 that allows a remote attacker on an adjacent network to execute arbitrary code without authentication or user interaction. The CVSS 3.1 score is 8.8 (HIGH) with full impact on confidentiality, integrity, and ava...