CVE-2026-8461-EXP

CVE-2026-8461 « PixelSmash » — Preuve de concept d’écriture hors limites du tas MagicYUV de FFmpeg !WARNING Ce dépôt contient une preuve de concept fonctionnelle pour une vulnérabilité de corruption du tas. Il est destiné uniquement à la recherche en sécurité autorisée, aux contextes CTF et à...

cve-2026-42945-nginx32-lab

Лаборатория эксплойта CVE-2026-42945 для nginx 32-bit Этот репозиторий представляет собой воспроизводимую Docker-лабораторию для изучения CVE-2026-42945 в nginx 1.30.0. Он содержит уязвимую 32-битную цель, триггер примитива, валидатор RCE с известным адресом, работающий при поддержке лаборатории,...

NotEnough

Инструмент для взлома таблицы Хаффмана Этот инструмент вычисляет хитрую каноническую гистограмму Хаффмана, которая способна вызвать внеполосную OOB запись для уязвимой библиотеки libwebp т.е. libwebp = 1.3.1. Эта уязвимость известна как CVE-2023-4863 или CVE-2023-41064. Мы можем переполнить...

EUVD-2026-71279

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

CVE-2026-80829

CVE-2026-80829 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in snd_usbmidi_novation_output(). A malformed or malicious USB device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1, causing the length passed to snd_rawmidi_transmit() to become ...

CVE-2026-80780

CVE-2026-80780 is an out-of-bounds write in the Linux kernel's HID: pidff driver, specifically in hid_pidff_init_with_quirks(). The function calls list_entry() on hid->inputs without verifying the list is non-empty. When hid->inputs is empty—possible with a USB device whose report descripto...

CVE-2024-43630-POC

CVE-2024-43630-POC Этот репозиторий содержит POC, который при выполнении вызывает запись за пределами стека OOB write, приводящую к краху системы. Эта уязвимость — чрезвычайно интересный и редкий артефакт, демонстрирующий сложность и особенности программирования ядра, особенно управления объектам...

EUVD-2026-70707

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-31431

CVE-2026-31431 — NULL 포인터에서 루트 권한까지: Linux 커널의 AFALG AEAD 익스플로잇 버그 클래스: NULL 포인터 역참조 → 힙 OOB 쓰기 → 자격 증명cred 덮어쓰기 영향받는 서브시스템: net/alg/afalg.c 영향: 로컬 권한 상승비특권 사용자 → root 영향받는 커널: Linux 4.4 – 4.9패치 전 요약 커널이 사용자 공간 주소를 기대하는 위치에 NULL 포인터를 전달하면서 setsockopt를 호출합니다. 커널은 주소 0x00000000에서 읽어옵니다. 그리고 제로 페이지를...

Linux Distros Unpatched Vulnerability : CVE-2026-80723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a...

CVE-2026-80725

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

CVE-2026-80725 net: gro: properly validate BIG TCP aggregation criteria

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

Chromium: CVE-2026-79138 Out of bounds write in ANGLE

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

EUVD-2026-67458

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

EUVD-2026-67031

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

EUVD-2026-66489

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

SUSE SLES15: kernel-livepatch-6_4_0-150600_23_103-default / etc (SUSE-SU-2026:3761-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3761-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.103 fixes various security issues: The following security issues were fixed: -...

CVE-2026-80580

CVE-2026-80580 is a buffer overflow in the Linux kernel fbdev subsystem. The function mode_string() uses snprintf(), which can return a value larger than the remaining buffer space. show_modes() accumulates this return value without checking whether the offset has reached PAGE_SIZE , allowing the...

CVE-2026-80522 crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...