CVE-2026-20466

In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...

CVE-2026-20466

A heap buffer overflow vulnerability in sec boot allows for a local escalation of privilege . An attacker with physical access to the device can exploit this without needing additional execution privileges or user interaction. This issue affects specific MediaTek hardware components. Remediation ...

Vulnerability Detection in AArch64 Machine Code Using a Digital Twin

This paper proposes an explainable digital twin for vulnerability detection in AArch64 machine code without access to source code. The digital twin reproduces the concrete execution of a program and preserves the state of registers, processor flags, memory, and live allocated blocks. Each...

PT-2026-76136

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::init sample timing table in libheif/sequences/track.cc stores an out-of-bounds chunk index m chunks.size into m presentation timeline when the number of chunks defined in the stco box is less than the numb...

PT-2026-76152

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76153

A heap-based buffer overflow vulnerability exists in the lossless jpeg load raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76154

An integer overflow vulnerability exists in the uncompressed fp dng load raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76197

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert fname function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is...

CVE-2026-20466: Out-of-bounds Write

In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...

CVE-2026-20478: Out-of-bounds Write

In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 Note: For MT6880, MT6890, MT6988, MT6990 / AUTO00851293...

PT-2026-76151

An integer overflow vulnerability exists in the deflate dng load raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-76146

A flaw was found in LibRaw. A heap-buffer-overflow in raw2image ex caused by a maliciously crafted file may lead to an application crash...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:49604)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49604 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

CVE-2026-20480: Heap-based Buffer Overflow

In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960023 Note: For MT6880, MT6890, MT6980D, MT6988, MT6990 /...

RHEL 9 : xorg-x11-server (RHSA-2026:49516)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49516 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user...

RockyLinux 8 : compat-libtiff3 (RLSA-2026:47183)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47183 advisory. libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image CVE-2026-12912 Tenable has extracted the preceding description block...

PT-2026-76192

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1 mbstring ncopy can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1...

PT-2026-76198

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html quote string function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity...

CVE-2026-68579

FreeRDP before 3.30.0 = 3.29.0 contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function client/Windows/wfcliprdr.c. When an OLE paste consumer e.g. explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file...

MariaDB: MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion

A heap buffer overflow vulnerability was discovered in the hatina::chainappend function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a...