CVE-2026-97441

A flaw was found in the Linux kernel's Advanced Host Controller Interface AHCI driver. When a storage controller reports more ports than can fit within its allocated Base Address Register BAR memory space, the driver attempts to access registers beyond the mapped boundary. A local attacker or...

CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

CVE-2026-97423

A flaw was found in the Linux kernel's Compute Express Link CXL subsystem. This vulnerability allows a local user to cause a Denial of Service DoS or system instability through an out-of-bounds memory access. During CXL region configuration, the kernel fails to validate that the partition index i...

CVE-2022-1015-1016

CVE-2022-1015 & CVE-2022-1026 This README.md is a translation of David's blog. David found CVEs 1015 and 1016 in the Linux kernel. You can visit his website to read the original document. Here are his social media links: Twitter Github An analysis of the two new Linux vulnerabilities in nftables...

CVE-2026-72897

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

UBUNTU-CVE-2026-72897

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

FreeBSD -- Heap out-of-bounds access in semop(2)

Problem Description: When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is...

CVE-2024-1939

CVE-2024-1939 This is a short writeup for the CVE-2024-1939, which I used to claim V8CTF M122. The root cause of this issue is the lack of support for kWasmS128 in wasm-to-js conversion. Specifically, wasmS128Const operations occurring in parameter stacks are ignored, leading to type confusion wh...

CVE-2022-26711

CVE-2022-26711: Apple ImageIO WebP Integer Overflow An integer overflow vulnerability in Apple's ImageIO framework when parsing WebP images, leading to an out-of-bounds memory access. Full Writeup - Detailed root cause analysis with disassembly walkthrough. Overview An integer overflow occurs...

expat security update

2.5.0-6.5 - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 2.5.0-6.4 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002...

CVE-2016-8863

Targets pupnp release-1.6.18 ... ... running on i386 Ubuntu 16.04. Fix commit 9c099c2923ab "Fix out-of-bound access in createurllist CVE-2016-8863"...

cve-2024-0519-rca-research

CVE-2024-0519 — RCA Research Root cause analysis artifacts for CVE-2024-0519 V8 out-of-bounds memory access, Chrome 120, exploited in the wild. Fix : e0f2a195d87c9a06685121e0e783efd92d030df3 — Toon Verwaest, 2024-01-12 V8 version studied : 12.0.267.16 fbc4963bbff, ARM64 macOS Files Path|...

CVE-2026-80844

🔥 CVE-2026-80844 - DirtyAH6 Escalada de privilegios local en el kernel de Linux mediante IPv6 AH6 CVE-2026-80844 es una vulnerabilidad del kernel de Linux que afecta al subsistema IPv6 Authentication Header AH6 / XFRM. La vulnerabilidad se debe a una validación insuficiente del campo segmentsleft...

CVE-2025-40019-POC

proof of concept for CVE-2025-40019 CVE-2025-40019 is the Encrypted Salt-Sector Initialization Vector mechanism crypto/essiv.c which has insufficient validation of Associated Authentication Data AAD length relative to the Initialization Vector IV size, leading to out-of-bounds memory access. The...

CVE-2021-1732

CVE-2021-1732 The vulnerability occurs in the Windows graphics driver win32kfull!NtUserCreateWindowEx function due to a desynchronization between kernel callback user-mode memory allocation and the setting of the tagWND-flag attribute. This allows an attacker to forge the tagWND-offset value,...

CVE-2022-1015

CVE-2022-1015 target: linux kernel 5.17.0 config: .config requirements: apt install libmnl-dev libnftnl-dev build: gcc exploit.c -o exploit -lmnl -lnftnl -lpthread -no-pie References...

CVE-2025-51495

I would like to report a security vulnerability identified in the latest release of Mongoose v7.17. The issue resides in the WebSocket module, specifically within the mgwscb function responsible for handling incoming WebSocket frames. The function is vulnerable to an integer overflow, which may...

d-os-descriptor

d-os-descriptor Summary The USB Gadget Subsystem includes security issues in the OS descriptor handling section of compositesetup function composite.c. Processing of properly crafted control transfer request messages result in device crash due to null pointer dereference or memory corruption...

CVE-2024-29943-but-with-wasm

CVE-2024-29943, pero con wasm Una cadena de explotación de extremo a extremo para CVE-2024-29943 que logra ejecución de código nativo arbitrario introduciendo shellcode en la página de código JIT de WebAssembly de SpiderMonkey como inmediatos f64.const — sin ROP, sin VirtualProtect, sin toolchain...

CVE-2026-98159

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware...