CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

EUVD-2026-60321

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

Important: Red Hat Security Advisory: haproxy security update

An update for haproxy is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

Important: Red Hat Security Advisory: haproxy security update

An update for haproxy is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

CVE-2026-71980

bcg729 (Belledonne Communications G.729 codec library, versions through 1.1.2) is vulnerable in the decodeSIDframe() function in src/cng.c. When a zero-length comfort-noise RTP payload is received, a uint8_t filter-order calculation underflows to 255, is clamped to 10, and causes an unconditional...

CVE-2026-71980 Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A...

CVE-2026-71980 Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A...

EUVD-2026-60315

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A...

CVE-2026-71980

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A...

CVE-2026-72033

A flaw was found in OrangeFS, a file system within the Linux kernel. An integer overflow occurs in the fillfrompart function when calculating the size of a directory entry. This happens because the size is computed as a 64-bit value but stored as a 32-bit value, allowing a large entry length to...

ANT-2026-669BEQ2W · WAMR · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-669BEQ2W: Integer overflow in array.new size...

ANT-2026-KP4YD2Z6 · php/php-src · Memory Corruption / Heap Buffer Overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-KP4YD2Z6: DBA flatfile length parsing triggers heap...

ANT-2026-PJV7Z0AR · open62541 · Integer Overflow

integer-overflow high CVE-2026-63559 CVE-2026-65423 Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-PJV7Z0AR: Integer...

ANT-2026-8HYRCFKW · DuckDB · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-8HYRCFKW: Integer overflow to heap buffer...

Important: Red Hat Security Advisory: haproxy security update

An update for haproxy is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...