47 matches found
CVE-2026-77622
The Sliver command and control framework (versions prior to 1.7.6 ) is vulnerable to an unauthenticated Denial of Service (DoS) attack via its HTTP(S) listener. The root cause is a lack of decoded-size or pixel limits in util/encoders/images.go, combined with a small, brute-forceable nonce space ...
CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...
CVE-2026-91186
A vulnerability exists in the PNG decoder because the chunk reader fails to enforce chunk ordering, allowing a second IHDR chunk to be processed. If an attacker provides a PNG file with a second IHDR chunk positioned after the IDAT chunk, the decoder rewrites the image dimensions (width, height, ...
CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...
CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...
GO-2026-6777 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...
PT-2026-118075
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...
GHSA-663M-7X7M-G4FW Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Summary Sliver is vulnerable to a Denial of Service DOS attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server,...
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Summary Sliver is vulnerable to a Denial of Service DOS attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server,...
DEBIAN-CVE-2026-56711
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process...
CVE-2026-56711
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process...
EUVD-2026-74906
VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as ibytes += p-ipitch p-ilines, and both planet fields are declared int in include/vlcpicture.h, so the...
CVE-2026-56711 VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process...
CVE-2026-56711
VLC media player 3.0.0 through 3.0.23 is affected by a heap out-of-bounds write caused by a 32-bit integer overflow in picture buffer allocation. In AllocatePicture (src/misc/picture.c), the fields i_pitch and i_lines are declared as int, so the multiplication wraps before widening to the size_t ...
CVE-2026-56711 VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process...
CVE-2026-56711
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process...
PT-2026-88993
Name of the Vulnerable Software and Affected Versions VLC media player versions 3.0.0 through 3.0.23 Description A memory-safety issue exists when processing crafted media, caused by an integer overflow. An integer overflow occurs when an arithmetic operation attempts to create a numeric value th...
CVE-2026-24823
The CVE-2026-24823 issue refers to an out-of-bounds write / buffer copy without size checks in FASTSHIFT X-TRACK, specifically in the PNG decoding path ( inflate.C within Software/X-Track/USER/App/Utils/lv_img_png/PNGdec/src modules). Affected software: X-TRACK up to and including v2.7. The Red H...
PT-2026-4898
Out-of-bounds Write, Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in FASTSHIFT X-TRACK Software/X-Track/USER/App/Utils/lv img png/PNGdec/src modules. This vulnerability is associated with program files inflate.C. This issue affects X-TRACK: through v2.7...