CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

PT-2026-80892

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...

Duplicate Advisory: Security Report: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x5ph-mj9p-rfr8. This link is maintained to preserve external references. Original Description NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses...

PYSEC-2026-3732

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

UBUNTU-CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

NLTK versions before 3.9.4 are affected by a symlink escape vulnerability in CorpusReader.open() . The root cause is that path validation is purely lexical and does not resolve symlinks, allowing a local attacker to place a symlink inside the corpus root to read arbitrary files outside the intend...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView . The root cause is that the component calls builtins.open() directly instead of the sandboxed pathsec.open() , effectively bypassing the pathsec.ENFORCE security mechanism. An attacker who controls t...

CVE-2026-63312 NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

CVE-2026-63312 NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

CVE-2026-63312: Improper Limitation of a Pathname to a Restricted Directory

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

PT-2026-79569

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.9.4 Description A symlink escape issue exists in the CorpusReader.open function. This occurs because path validation is performed lexically and fails to account for symlink resolution. Consequently, a local attacker ca...

PT-2026-79563

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0 Description An arbitrary local file read issue exists in StreamBackedCorpusView where the system bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid...