CVE-2022-44318

Description of CVE-2022-44318 PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall. Any project or library that uses Picoc also suffers from this issue. An example of this would be...

CVE-2026-97631

A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service DoS...

CVE-2026-53921

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

CVE-2016-2233

CVE-2016-2233 CVE-2016-2233 is a stack-based buffer overflow vulnerability related with a wide-used IRC software Hexchat. We build a IRC server and launch the attack on it to make all the client connected to the server crash. We exploited our attack on Ubuntu 12.04 using Python. We make a patch t...

CVE-2026-41089-PoC

CVE-2026-41089 — LongLogon crasher PoC Pre-authentication stack buffer overflow in the Netlogon service of Windows Server 2025. A single CLDAP packet UDP/389 from any host on the wire is enough: lsass.exe dies with STATUSSTACKBUFFEROVERRUN 0xc0000409 and the domain controller reboots. Component:...

CVE-2026-53921

A critical stack-based buffer overflow exists in the odhcpd daemon of OpenWrt , affecting versions prior to 24.10.8 and 25.12.5 . The vulnerability is triggered during the serialization of DHCPv6 Reply packets in the build_ia() and dhcpv6_ia_handle_IAs() functions. When processing a specially cra...

CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

CVE-2026-98917

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

EUVD-2026-108826

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...

CVE-2026-99031 net: bridge: avoid recursive multicast port cleanup

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...

CVE-2026-99031

The Linux kernel contains a vulnerability in the net: bridge component where the function br_multicast_sg_del_exclude_ports() performs a recursive call to br_multicast_del_pg(). For S,G entries , this recursion causes each STAR_EXCL port to consume one kernel stack frame. A large number of these ...

CVE-2026-99021

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

CVE-2026-98900

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

DEBIAN-CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98882

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-115723

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...

expat security update

An update is available for expat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: expat:...