NotEnough

Huffman table hacking tool This tool calculates tricky canonical huffman histogram, which is able to trigger OOB Out Of Band write for vulnerable libwebp library i.e. libwebp = 1.3.1. This vulnerability is known as CVE-2023-4863 or CVE-2023-41064. We can overflow the pre-allocated huffman table b...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32-bit Exploit Lab This repository is a reproducible Docker lab for studying CVE-2026-42945 in nginx 1.30.0. It contains a vulnerable 32-bit target, a primitive trigger, a lab-assisted known-address RCE validator, and a no-introspection brute-force driver. The proof boundary...

CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...

CVE-2024-43630-POC

CVE-2024-43630-POC This repository contains a POC that triggers a stack OOB write when executed, causing the system to crash. This vulnerability is an extremely interesting and rare relic that demonstrates the complexities and peculiarities of kernel programming, especially object management...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

CVE-2026-58809

In smmudomainconfigs1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58809

A missing bounds check in smmu_domain_config_s1 of arm-smmu-v3.c leads to a possible Out-of-Bounds (OOB) Write . This vulnerability could result in local escalation of privilege , requiring System execution privileges to exploit. Exploitation does not require user interaction. No specific remedia...

EUVD-2026-122624

In smmudomainconfigs1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58809

In smmudomainconfigs1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

TUNderflow

TUNderflow CVE-2026-81000 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your u...

sqlite-session-ncol

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-session-ncol Write-up: https://abraxaslabs.tech/research/sqlite-session-ncol sqlite-session-ncol Class: heap OOB write Reach: Local SQLite 3.53.4 b09c88c14082339b66c7b7158d609a771e64ca69, SOURCEID 2026-07-24...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3389)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3389 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring CVE-2026-74356 In the Linux kernel, the following vulnerability has been...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams calculates the size of each URB transfer buffer before adding the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; i...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

SUSE SLES12 Security Update : ghostscript (SUSE-SU-2026:5094-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5094-1 advisory. - CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free bsc1284397. -...

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree bsc1252918. CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item...

cve-2026-99999-audit

cve-2026-99999-audit -9.3%20CRITICAL-critical?style=flat-square Read-only audit script for CVE-2026-99999 a.k.a. PwnEscape. The bug is in the Linux kernel's IPv4 stack: it trusts the checksum metadata a packet arrives with. An untrusted VM guest can use it to escape to the host, and a local user ...

gitlab-rce-toolkit

GitLab Onigmo RCE Exploit Toolkit CVE-2026-97229 + CVE-2026-110264 — Two critical CVSS 10.0 unauthenticated RCE vulnerabilities in GitLab CE/EE via Onigmo regex engine integer overflow. Authorized testing only. Every target must be yours or covered by written authorization. Vulnerabilities CVE|...