CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54333

CVE-2026-54333 is a stack out-of-bounds write in the uefi-firmware Python package (UEFI Firmware Parser). The vulnerable function MakeTable() in uefi_firmware/compression/Tiano/Decompress.c fails to validate that bit-length values from a crafted Tiano/EFI compressed firmware bitstream stay within...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

CVE-2026-19542 Stack-based out-of-bounds write in tdelete during tree rebalancing

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: Fixed the potential out-of-bounds write issue during NVMEM read operations in PCF85063. The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem...

CVE-2026-33960

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...

PT-2026-91000

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver due to missing input length validation in color mode LUT parsing leads to kernel memory corruption and potentia...

About the security content of macOS Tahoe 26.7

Download JSON About the security content of macOS Tahoe 26.7 This document describes the security content of macOS Tahoe 26.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

MGASA-2026-0398 Updated ffmpeg package fixes security vulnerabilities

Out-of-Bounds Write in RASC Decoder decodedlta. CVE-2026-58049 Heap Buffer Overflow via VobSub Subtitle Demuxer. CVE-2026-64830 Double-Free in NVDEC Hardware Decoder via nvdec.c. CVE-2026-64832 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c. CVE-2026-64833 Infinite Loop DoS via RTP/ASF Demuxer...

SUSE CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

Linux Distros Unpatched Vulnerability : CVE-2026-89495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: bound namelen in dlmmigraterequesthandler Patch series ocfs2/dlm: bound peer-controlled lengths in the o2dlm. The o2dlm receive handlers trust u8 length...

Linux Distros Unpatched Vulnerability : CVE-2026-89656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from...

CVE-2026-89725

A flaw was found in the Linux kernel's media: cec: stm32 driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control CEC message without an end-of-message signal. This causes the driver to write beyond an allocated buffer,...

CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

DEBIAN-CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

AZL-100100 CVE-2026-89495 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

DEBIAN-CVE-2026-80960

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...

UBUNTU-CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

UBUNTU-CVE-2026-89607

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encryptedkeysize in parsetag3packet parsetag3packet set encryptedkeysize from the Tag 3 packet body without bounding it against ECRYPTFSMAXKEYBYTES 64. When encryptedkeysize 64,...