CVE-2026-110875

AdPlug versions through 2.4 are vulnerable to a heap-based buffer overflow in the CksmPlayer::update() function located in src/ksm.cpp. The vulnerability occurs because the software writes past the fixed databuf[2048] array without performing proper bounds checking. An attacker can exploit this b...

CVE-2026-110875 AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...

CVE-2026-110875 AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...

CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-55246 bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookieinitfile in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled numpages field as the loop bound for byte-swapping pagesizes entries. A crafted file can make the loop re...

CVE-2026-55246

The bincookie header-only binarycookies parser is vulnerable to a heap buffer overflow and out-of-bounds write in versions prior to 0.1.9 . The root cause lies in the bincookie_init_file() function within bincookie.h, which uses the file-controlled num_pages field as a loop bound for byte-swappin...

libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding

A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...

libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

Important: Red Hat Security Advisory: libsoup3 security update

An update for libsoup3 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth

A flaw was found in libsoup. When max-incoming-payload-size is unlimited 0, SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data...

libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow...

Astra Linux – Vulnerability in imagemagick

ImageMagick prior to version 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex, which is caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation is performed. Attackers can exploit this vulnerability to trigger memory and disk...

Astra Linux – Vulnerability in Vim

Vim is a revised version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position within the typeahead buffer, but it does not check whether there is enough space left in the buffer to handle the next characters. This can cause the off position within the...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, a underflow of a sizet variable in the IMA-ADPCM and MS-ADPCM audio decoders led to a heap-buffer-overflow issue through the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decode...

Astra Linux – Vulnerability in SOX

A heap buffer overflow vulnerability was discovered in sox, within the lsxreadbuf function at sox/src/formatsi.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure...

Astra Linux – Vulnerability in libxml-parser-perl

XML::Parser versions up to 2.47 for Perl have a heap buffer overflow issue in stserialstack. In the case where stackptr == stacksize - 1, the stack will NOT be expanded. As a result, the new value will be written at location ++stackptr, which equals stacksize. This means that the new value falls...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation, due to insufficient validation of client-controlled size parameters. This allows for out-of-bounds writes via crafted PDUs. Pre-authentication...

Astra Linux – Vulnerability in TeXeVe-bin

It was discovered that texlive-bin commit c515e contains a heap buffer overflow vulnerability through the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service DoS by providing a malicious TTF file...