PT-2026-115158

Game Music Emu libgme through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme...

CVE-2026-110698

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110698

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110695

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110698

The Praat software (up to version 7.0.02 ) contains an out-of-bounds write vulnerability in the Model Loader component. Specifically, the whisper_model_load function within the external/whispercpp/whisper.cpp file is affected due to the manipulation of the n_dims argument. This vulnerability can ...

CVE-2026-110698 Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110698 Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

CVE-2026-110694

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110695 turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.gettensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument dataoffsets results in buffer overflow. The attack is possible to be...

CVE-2026-110695

The turboderp ExLlamaV2 library (up to version 0.3.2 ) contains a buffer overflow vulnerability in the Safetensors Tensor Loader component. Specifically, a manipulation of the data_offsets argument within the STFile.get_tensor function in exllamav2/stloader.py can trigger this overflow. This vuln...

EUVD-2026-101662

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110694 OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110694 OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds

A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function gettmfilemodel of the file source/serializer/tmfile/tm2serializer.c of the component tmfile Model Loader. Such manipulation of the argument offsetroot leads to out-of-bounds read. It is possible t...

CVE-2026-110694

OAID Tengine versions up to 1.12.0 are vulnerable to an out-of-bounds read in the tmfile Model Loader component. The flaw exists in the get_tm_file_model function within the file source/serializer/tmfile/tm2_serializer.c due to improper handling of the offset_root argument. This vulnerability can...

CVE-2026-103414

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...

EUVD-2026-101497

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...

CVE-2026-103414

The GUIX binary resource (theme) loader is vulnerable to an out-of-bounds write (CWE-787) due to independent cursor arithmetic used in two separate passes while traversing resource files. Because gx_page_header_data_size is not validated against actual glyph data, the loader may derive inconsiste...

CVE-2026-103414

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...