Microsoft Office Word Information Disclosure Vulnerability

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

JLSEC-2026-1243 A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in...

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

JLSEC-2026-1247 A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list...

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

PT-2026-70705

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An off-by-one error occurs when a program writes or reads one element past the end of an array, which can lead to memory corruption or information disclosure. In this case, the...

DEBIAN-CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2026-71391 Off-by-One Error in GNU Emacs for Android

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2026-71391

GNU Emacs for Android is affected by an off-by-one in the gvar table parser (src/sfnt.c). The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a > comparison instead of >=, allowing a crafted TrueType variable font to bypass the check an...

CVE-2026-71391 Off-by-One Error in GNU Emacs for Android

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: tiam335xtsc – fixed an off-by-one error in the wireorder validation. The current validation wireorderi ARRAYSIZEconfig pins allows wireorderi to equal ARRAYSIZEconfig pins, which causes out-of-bounds access when used as an...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fixed an off-by-one error in the setupnicdevices cleanup process. In setupnicdevices, the initialization loop jumps to the label setupnicdevfree if there is a failure. The current cleanup loop whilei-- skips the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe The “index” variable is used as an index into the usbphyc-phys array, which has usbphyc-nphys elements. If the “index” equals usbphyc-nphys, then it refers to an element that is out of...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fixed an off-by-one error in the setupnicdevices cleanup routine. In setupnicdevices, the initialization loop jumps to the setupnicdevfree label if a failure occurs. The current cleanup loop whilei-- skips the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: iavf: Fixed off-by-one issues in iavfconfigrssreg There are off-by-one bugs when configuring the RSS hash key and lookup table, causing out-of-bounds reads to memory 1 and out-of-bounds writes to device registers. Before commi...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fixed an off-by-one buffer overflow in alarmsstore. The sysfs buffer passed to alarmsstore is allocated with ‘size + 1’ bytes, and a NUL terminator is appended. However, the ‘size’ argument does not account for this...

Astra Linux – Vulnerability in Qemu

An “off-by-one” error was detected in QEMU’s KVM Xen guest support. A malicious guest could exploit this flaw to trigger out-of-bounds heap accesses in the QEMU process through the emulated Xen physdev hypercall interface, resulting in a denial of service or potential memory corruption...

Linux Distros Unpatched Vulnerability : CVE-2026-71391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared- coordinate index boundary check in sfntvarysimpleglyph an...