NotEnough

Huffman table hacking tool This tool calculates tricky canonical huffman histogram, which is able to trigger OOB Out Of Band write for vulnerable libwebp library i.e. libwebp = 1.3.1. This vulnerability is known as CVE-2023-4863 or CVE-2023-41064. We can overflow the pre-allocated huffman table b...

GO-2026-6888 Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new...

[slackware-security] proftpd

New proftpd packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/proftpd-1.3.9e-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Support opt-in use of Huffman encoding only for SS...

Astra Linux – Vulnerability in libstb

It was discovered that stbimage.h v2.27 contains a heap-based use-after-free issue due to the stbijpeghuffdecode function...

Linux Distros Unpatched Vulnerability : CVE-2026-44038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an...

CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

CVE-2026-44038

OFFIS DCMTK 3.7.0 is vulnerable to a global out-of-bounds read within the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12, and libijg16). The root cause is a lack of range-checking on Huffman symbol values, which allows an attacker to read memory beyond the extend_tes...

CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

CVE-2026-44038 Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

Summary When decoding a fax-compressed strip TIFF Compression=3 / Group 3 1D, or Compression=2 / Modified Huffman, the CCITT decompressors write decoded runs through BitWriterUtils.WriteBits/WriteBit/WriteZeroBit, which advance and write bits via Unsafe.Add with read-modify-write semantics —...

EUVD-2026-93560

ImageSharp: CCITT fax decompression T4/Modified Huffman: unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp...

CVE-2026-106117

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

CVE-2026-106117: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel (ALMALINUX9.2:CLSA-2026:1776438517)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776438517 advisory. - GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

Astra Linux – Vulnerability in grub2

A heap out-of-bounds write may occur during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. The impacts on confidentiality, integrity, and availability are considered low, as it is very complex for an attacker to control the encoding and...

CVE-2026-46603

A flaw was found in golang.org/x/image/vp8l. A remote attacker can cause a denial of service by providing a specially crafted VP8L image. This image, containing many unused Huffman tree groups, leads to excessive memory allocation during VP8L decoding, resulting in memory exhaustion. Mitigation...

SUSE CVE-2026-77118

A heap out-of-bounds write exists in the Photo CD PCD decoder of GraphicsMagick. In DecodeImage coders/pcd.c, the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is...

CVE-2026-55586

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

EUVD-2026-63469

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...

CVE-2026-55586

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to makedecodetable in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through nextsymbol before validating that the canonical...