CVE-2026-0132: Undefined Security Weakness

In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0149: Undefined Security Weakness

In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

RHEL 10 : gnutls (RHSA-2026:26409)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:26409 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such ...

SQLite < 3.53.2 Multiple Heap Buffer Overflows

The version of SQLite installed on the remote host is prior to 3.53.2. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer overflow vulnerability in the FTS5 full-text search extension allows attackers to cause a crash or execute arbitrary code by supplying a crafted...

EUVD-2025-210150

A heap buffer overflow in the gfisomvpconfignew function isomedia/avcext.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-210145

A heap buffer overflow in the gfcencsetpssh function isomedia/drmsample.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55652

A heap buffer overflow in the gfisomvpconfignew function isomedia/avcext.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2026-52720

A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...

CVE-2026-8357

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element pa...

CVE-2026-8357

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element pa...

CVE-2026-6047 Heap buffer overflow in OOXML text box element import

LibreOffice can import documents in the OOXML format DOCX. A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed...

CVE-2026-6047

LibreOffice can import documents in the OOXML format DOCX. A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed...

CVE-2026-6045

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...

libarchive:libarchive_fuzzer: Heap-buffer-overflow in aes_ctr_update

Project: https://github.com/libarchive/libarchive.git Detailed Report: https://oss-fuzz.com/testcase?key=4648224800178176 Project: libarchive Fuzzing Engine: afl Fuzz Target: libarchivefuzzer Job Type: aflasanlibarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libssh:ssh_client_config_fuzzer: Heap-buffer-overflow in ssh_config_parse_line_internal

Project: https://git.libssh.org/projects/libssh.git Detailed Report: https://oss-fuzz.com/testcase?key=6445180799221760 Project: libssh Fuzzing Engine: libFuzzer Fuzz Target: sshclientconfigfuzzer Job Type: libfuzzerasanlibssh Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

CVE-2025-55661

A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2026-6039: Out-of-bounds Write

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose...

CVE-2025-55645

A heap buffer overflow in the gfcencsetpssh function isomedia/drmsample.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55648

GPAC MP4Box v2.4 contains a heap buffer overflow in the gf_opus_parse_packet_header function located in media_tools/av_parsers.c. An attacker can exploit this vulnerability by supplying a crafted MP4 file to cause a Denial of Service (DoS) . Additionally, documentation suggests that exploiting th...

CVE-2026-6047: Out-of-bounds Write

LibreOffice can import documents in the OOXML format DOCX. A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed...