32385 matches found
EUVD-2026-101720
FreeRDP 2.0.0 before 3.32.0, when built with WITHLAME=ON and WITHDSPFFMPEG=OFF, has a heap-based buffer overflow in freerdpdspdecodemp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded sampl...
CVE-2026-79822: Heap-based Buffer Overflow
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow...
CVE-2026-101307: Heap-based Buffer Overflow
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the...
UBUNTU-CVE-2026-110839
FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...
CVE-2026-55246: Heap-based Buffer Overflow
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...
PT-2026-115246
Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description A heap-based buffer overflow occurs in Microsoft Office, which allows an unauthorized attacker to execute arbitrary code over a network. A heap-based buffer overflow is a memory...
CVE-2026-108444: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network...
PT-2026-115251
Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Word, this flaw...
CVE-2026-108449: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-108450: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-115249
Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Word, this flaw...
CVE-2026-108447: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
PT-2026-115250
Name of the Vulnerable Software and Affected Versions Microsoft Office Outlook affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Outlook, this...
CVE-2026-108448: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
PT-2026-115234
Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Word, this flaw...
CVE-2026-111272: Out-of-bounds Read
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...
CVE-2026-111273: Off-by-one Error
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...
CVE-2026-110837
FreeRDP 2.0.0 before 3.32.0, when built with WITHLAME=ON and WITHDSPFFMPEG=OFF, has a heap-based buffer overflow in freerdpdspdecodemp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded sampl...
UBUNTU-CVE-2026-110837
FreeRDP 2.0.0 before 3.32.0, when built with WITHLAME=ON and WITHDSPFFMPEG=OFF, has a heap-based buffer overflow in freerdpdspdecodemp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded sampl...