CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

CVE-2026-14899

The CVE-2026-14899 issue is a memory-safe vulnerability in Thunderbird’s MIME header parser when forwarding messages with headers visible. An off-by-one error could allow reading a byte beyond the header buffer, potentially causing a crash. Affected component: Thunderbird MIME header parsing duri...

gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling

A flaw was found in gnutls. An off-by-one error exists in the PKCS12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of...

ALPINE-CVE-2026-44687

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

unbound: Unbound: Denial of Service due to 'harden-below-nxdomain' logic bypass

An off-by-one error in Unbound's default harden-below-nxdomain logic can lead to a denial of service. When an intermediate label under a DNSSEC-signed zone is queried, the flaw incorrectly bypasses configured stub or forward zones, disrupting their name resolution...

Security Bulletin: IBM Event Endpoint Management is affected by multiple vulnerabilities.

Summary IBM Event Endpoint Management is affected by multiple vulnerabilities. These are affecting the operator and frontend components. Vulnerability Details CVEID:CVE-2026-31988 DESCRIPTION: yauzl aka Yet Another Unzip Library version 3.2.0 for Node.js contains an off-by-one error in the NTFS...

CVE-2026-44687 Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-44687

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

UBUNTU-CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

The CVE-2026-16473 vulnerability affects the sbc library used by the BlueZ SBC codec. A off-by-one bug in the SBC frame decoder enables a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of a...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

EUVD-2026-47623

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory. Mitigation...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

PT-2026-63484

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description An off-by-one error exists in the code used to parse MIME headers Multipurpose Internet Mail Extensions for display when forwarding a message, specifically when...

SUSE CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

Security Vulnerabilities fixed in Thunderbird 153 — Mozilla

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. Memory safety bugs present in...