MariaDB: MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion

A heap buffer overflow vulnerability was discovered in the hatina::chainappend function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a...

CVE-2026-67305

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

CVE-2026-67298

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

CVE-2026-67305

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

OESA-2026-3216 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture...

CVE-2026-67305: Heap-based Buffer Overflow

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

CVE-2026-67298: Integer Underflow (Wrap or Wraparound)

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within .solv files due to insufficient input validation. An attacker can provide a specially crafted .solv file, which, when processed by a vulnerable application, can lea...

Chromium: CVE-2026-17758 Heap buffer overflow in Dawn

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE-SU-2026:23109-1 Security update for spice-vdagent

This update for spice-vdagent fixes the following issues: - CVE-2026-57965: integer overflow in udscswrite allows a compromised SPICE host to crash the spice-vdagent daemon via a specially crafted message that triggers a heap buffer overflow bsc1269553. - CVE-2026-57966: improper sanitization...

OPENSUSE-SU-2026:21506-1 Security update for spice-vdagent

This update for spice-vdagent fixes the following issues: - CVE-2026-57965: integer overflow in udscswrite allows a compromised SPICE host to crash the spice-vdagent daemon via a specially crafted message that triggers a heap buffer overflow bsc1269553. - CVE-2026-57966: improper sanitization...

vlc:vlc-demux-dec-libfuzzer-ty: Heap-buffer-overflow in packetizer_PacketizeBlock

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=4765936858234880 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-ty Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 9 Crash Address: 0x76d3554e0e00...

SUSE CVE-2026-17680

Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

RHEL 9 : libsolv (RHSA-2026:48814)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:48814 advisory. The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv: Heap buffer...

RHEL 8 : libsolv (RHSA-2026:48815)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:48815 advisory. The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv: Heap buffer...

PT-2026-76127

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet length smaller than the cipher's block size during...

CVE-2026-63033

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer...

openbabel:fuzz_convert: Heap-buffer-overflow in OpenBabel::TSimpleMolecule::redraw

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5121501851090944 Project: openbabel Fuzzing Engine: libFuzzer Fuzz Target: fuzzconvert Job Type: libfuzzerasanopenbabel Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

libiec61850:fuzz_mms_encode: Heap-buffer-overflow in BerEncoder_encodeBitString

Project: https://github.com/mz-automation/libiec61850.git Detailed Report: https://oss-fuzz.com/testcase?key=4812125491757056 Project: libiec61850 Fuzzing Engine: libFuzzer Fuzz Target: fuzzmmsencode Job Type: libfuzzerasanlibiec61850 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1...

JLSEC-2026-894

A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service...