CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV 堆 OOB 写入 PoC !WARNING 本仓库包含一个针对堆损坏漏洞的有效利用 PoC。 仅供授权的安全研究、CTF 环境和防御性分析使用。 请勿对非你拥有或未经明确书面许可的系统进行测试。 受影响: FFmpeg 8.0.1 MagicYUV 解码器 libavcodec/magicyuv.c 原语: 堆 OOB 写入 → AVBuffer.free 劫持 → system 调用 漏洞 magydecodeslice 使用 sheight（未限制的切片高度）作为写入 Cb/Cr...

NotEnough

Huffman表构建工具 此工具用于计算棘手的规范哈夫曼直方图，该直方图能够触发易受攻击的libwebp库（即 libwebp = 1.3.1）的越界（OOB）写入。此漏洞编号为 CVE-2023-4863 或 CVE-2023-41064。我们最多可以溢出预分配的哈夫曼表 132 个条目 。 原理在于，libwebp 假设每个 webp 图像中包含的哈夫曼直方图格式良好。也就是说，解码树必须是一棵完全树 。基于这一假设，libwebp 团队利用 enough 工具来估算构建解码哈夫曼表（一种用于快速解码规范哈夫曼码的强大结构）所需的最大内存大小。然而，攻击者能够构造一棵不完全树...

CVE-2024-43630-POC

CVE-2024-43630-POC 此仓库包含一个POC，执行时会触发栈上越界写入，导致系统崩溃。该漏洞是一个非常有趣且罕见的遗物，展示了内核编程（尤其是对象管理）的复杂性和特殊性。此外，该漏洞影响Windows 11 24h2、Windows 10 22h2/21h2的内核，但不影响Windows 11 22h2/23h2，这更增添了其趣味性。 于2024年11月12日修补 受影响的Windows版本 Windows 11 版本 24H2 Windows 10 版本 22H2 Windows 10 版本 21H2 Windows Server 2025 Windows Server...

TUNderflow

TUNderflow CVE-2026-81000 Writeup !WARNING 本 PoC 仅用于帮助防御者、维护者和经授权的安全团队，在他们拥有或明确获授权测试的系统上验证补丁、缓解措施、检测规则和暴露面。 您需自行负责确保对本材料的使用是合法、经授权、受控的，并在隔离的测试环境中进行。 !WARNING 本 PoC 具有破坏性。 它会修改 /etc/pam.d/su，且没有任何回滚机制。 一次位置错误的覆写可能会破坏无关的内核内存，导致机器挂起或崩溃。 仅在一次性 VM/可丢弃主机上运行。 该 PoC： 1. 进入私有的用户/网络命名空间，创建 TUN 设备以及...

SUSE SLES15 Security Update : python-pymongo (SUSE-SU-2026:4398-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4398-1 advisory. - CVE-2026-96747: improper handling of key management endpoint values ending in .sock allows users with write access to the encryption key...

CVE-2026-31431

CVE-2026-31431 — 从空指针到 Root：利用 Linux 内核中的 AFALG AEAD 漏洞类型： 空指针解引用 → 堆越界写入 → 凭据覆盖 受影响子系统： net/alg/afalg.c 影响： 本地权限提升（非特权用户 → root） 受影响内核： Linux 4.4 – 4.9（补丁前） 简述 你调用 setsockopt 时传入一个 NULL 指针，而内核期望的是一个用户空间地址。内核从地址 0x00000000 读取数据——如果你已经映射了零页，你就能控制它读取的内容。这一原始原语会滚雪球式地演变为堆越界写入，让你能够覆盖自己的 cred 结构体。游戏结束。...

Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Rocky Linux 9 [CIQ] Security Update: grub2-common / grub2-debuginfo / grub2-debugsource / grub2-efi-aa64 / etc (crlsa-2025_20532)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202520532 advisory. grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write. CVE-2024-45777 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_11299)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202411299 advisory. gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer CVE-2024-47540 gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c...

Rocky Linux 9 [CIQ] Security Update: freetype / freetype-debuginfo / freetype-debugsource / etc (crlsa-2025_3407)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253407 advisory. freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files CVE-2025-27363 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: freetype / freetype-debuginfo / freetype-debugsource / etc (crlsa-2025_3421)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253421 advisory. freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files CVE-2025-27363 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: mingw32-freetype / mingw32-freetype-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_8292)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258292 advisory. freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files CVE-2025-27363 libsoup: Integer overfl...

Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (crlsa-2024_8162)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20248162 advisory. kernel: Local information disclosure on IntelR AtomR processors CVE-2023-28746 kernel: netfilter: nftflowoffload: reset dst in route object after setting u...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1749826187)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1749826187 advisory. - GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed...

Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_11122)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202411122 advisory. gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer CVE-2024-47540 gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1727167500)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1727167500 advisory. - btsockrecvmsg in net/bluetooth/afbluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a btsockioctl race...

kernel-rt security update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

RLSA-2026:72467 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports...

AlmaLinux 9.2 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778756042)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778756042 advisory. - OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (CENTOS7:CLSA-2025:1763139214)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1763139214 advisory. - GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function...