BIT-MONGODB-2026-13077 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-58088

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

CVE-2026-58087

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

EUVD-2026-62365

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

CVE-2026-58088

Affected: All supported FreeBSD versions. Root cause: A race condition in ELF core dump code — a second-pass write to the program-header buffer is not bounds-checked against the count from the first pass, so a process sharing the address space via rfork(2) can mutate the VM map between passes. Im...

CVE-2026-58088 Race condition in ELF core dump segment counting

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

CVE-2026-58087

CVE-2026-58087 is a heap out-of-bounds access in the GETALL and SETALL commands of FreeBSD's semctl(2) system call. The root cause is a sequence-number wrap after 0x8000 create/destroy cycles: an unprivileged local user can rapidly destroy and recreate semaphore sets at the same index, causing a ...

CVE-2026-58087 Heap out-of-bounds access in semctl(2)

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

EUVD-2026-62363

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900 Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900

swtpm's SWTPM_NVRAM_CheckHeader() validates buffer length against sizeof(pointer) instead of sizeof(struct), allowing an undersized buffer to pass and cause a 2-byte heap overread (6 bytes on 32-bit). Impact: daemon termination and heap data leakage to logs. Red Hat reports no mitigation; fixed i...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-49429

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...

gstreamer1-plugins-bad-free security update

An update is available for gstreamer1-plugins-bad-free. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs ...

CVE-2026-49430

In the ZFS_IOC_RECV_NEW heal path, OpenZFS truncates a 64-bit payload size to 32-bit for allocation but uses the original 64-bit size as the byteswap length, causing a heap overflow exploitable by any local user with the "receive" delegated permission. Fixed in FreeBSD 14.3/14.4/15.0/15.1 release...

CVE-2026-49429 Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...

CVE-2026-49429

A kernel heap overflow in the OpenZFS component of FreeBSD affects the ZFS_IOC_USERSPACE_MANY ioctl used by zfs-userspace(8). The root cause is a 64-bit to 32-bit truncation : the output buffer size is truncated to 32 bits for kernel allocation, but the original 64-bit value is used as the write ...