EUVD-2026-63428

Sony XAV-9500ES l2reassemblesdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

CVE-2026-18281 Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability

Sony XAV-9500ES l2reassemblesdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

CVE-2026-18281

CVE-2026-18281 is a heap-based buffer overflow in the Sony XAV-9500ES car audio/video receiver, specifically in the l2_reassemble_sdu function that handles Bluetooth L2CAP packets . The root cause is the lack of proper length validation on user-supplied data before copying it into a heap-based bu...

EUVD-2026-63418

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specifi...

CVE-2026-18271 Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specifi...

CVE-2026-18271 Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specifi...

CVE-2026-55194

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

CVE-2026-76917

A flaw was found in Wireshark. A heap-based buffer overflow vulnerability exists within the Bluetooth Audio/Video Remote Control Profile AVRCP protocol dissector. This flaw can be triggered by a local user processing a specially crafted Bluetooth AVRCP packet, which requires user interaction...

EUVD-2026-63388

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow...

CVE-2026-16928 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow...

USN-8653-1 postgresql-14, postgresql-16, postgresql-18 vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

AZL-97485 CVE-2026-18917 affecting package libvirt for versions less than 11.9.0-1

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

CVE-2026-18917

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

DEBIAN-CVE-2026-18917

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

OESA-2026-3488 entr security update

A file watcher, which can run specified commands when target files change. Security Fixes: entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the...

OESA-2026-3487 entr security update

A file watcher, which can run specified commands when target files change. Security Fixes: entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the...

OESA-2026-3479 libssh2 security update

libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS22, SECSH-USERAUTH25, SECSH-CONNECTION23, SECSH-ARCH20, SECSH-FILEXFER06, SECSH-DHGEX04, and SECSH-NUMBERS10. Security Fixes: libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds he...

OESA-2026-3466 libXfont2 security update

libXfont provides the core of the legacy X11 font system, handling the index files fonts.dir, fonts.alias, fonts.scale, the various font file formats, and rasterizing them. contains runtime library. Security Fixes: A flaw was found in the libXfont2 font-server client. This heap buffer overflow...

OESA-2026-3444 diffutils security update

GNU Diffutils is a package of several programs related to finding differences between files. Security Fixes: diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line rang...

OESA-2026-3424 postgresql-17 security update

PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...