CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...

CVE-2024-43630-POC

CVE-2024-43630-POC This repository contains a POC that triggers a stack OOB write when executed, causing the system to crash. This vulnerability is an extremely interesting and rare relic that demonstrates the complexities and peculiarities of kernel programming, especially object management...

NotEnough

Huffman table hacking tool This tool calculates tricky canonical huffman histogram, which is able to trigger OOB Out Of Band write for vulnerable libwebp library i.e. libwebp = 1.3.1. This vulnerability is known as CVE-2023-4863 or CVE-2023-41064. We can overflow the pre-allocated huffman table b...

CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

Important: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

RHEL 9 : ghostscript (RHSA-2026:83553)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83553 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitma...

AlmaLinux 10 : ghostscript (ALSA-2026:83551)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83551 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript:...

ghostscript security update

9.54.0-19.3 - RHEL-273957 CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data 9.54.0-19.2 - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free via Type 5 shading OOB...

AZL-108116 CVE-2026-98407 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

DEBIAN-CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

EUVD-2026-101056

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

The Linux kernel contains a heap Out-of-Bounds (OOB) write vulnerability in the wifi: rsi component. The issue occurs within the rsi_hal_load_key() function when a key is removed (where data == NULL). Because the set_key pointer is typed as struct rsi_set_key *, the subscripting operation scales ...

Linux Distros Unpatched Vulnerability : CVE-2026-98407

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ...