PT-2026-115142

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch sf2 gen is valid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-110735

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

CVE-2026-110698

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110695

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110698 Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110698 Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110698

The Praat software (up to version 7.0.02 ) contains an out-of-bounds write vulnerability in the Model Loader component. Specifically, the whisper_model_load function within the external/whispercpp/whisper.cpp file is affected due to the manipulation of the n_dims argument. This vulnerability can ...

CVE-2026-110694

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110695

The turboderp ExLlamaV2 library (up to version 0.3.2 ) contains a buffer overflow vulnerability in the Safetensors Tensor Loader component. Specifically, a manipulation of the data_offsets argument within the STFile.get_tensor function in exllamav2/stloader.py can trigger this overflow. This vuln...

CVE-2026-110694

OAID Tengine versions up to 1.12.0 are vulnerable to an out-of-bounds read in the tmfile Model Loader component. The flaw exists in the get_tm_file_model function within the file source/serializer/tmfile/tm2_serializer.c due to improper handling of the offset_root argument. This vulnerability can...

EUVD-2026-101662

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110694 OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110694 OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-103414

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...

CVE-2026-103414

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...

CVE-2026-103414

The GUIX binary resource (theme) loader is vulnerable to an out-of-bounds write (CWE-787) due to independent cursor arithmetic used in two separate passes while traversing resource files. Because gx_page_header_data_size is not validated against actual glyph data, the loader may derive inconsiste...

EUVD-2026-101497

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...