CVE-2026-125183 FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps3dextension in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit...

PT-2026-141011

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps 3d extension in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit...

opnsense-ntp-gps-fudge

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-ntp-gps-fudge Write-up: https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge opnsense-ntp-gps-fudge Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of...

DEBIAN-CVE-2026-102485

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

CVE-2026-102485

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

CVE-2026-102485

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

CVE-2026-102485 Out-of-bounds Read in ntpsec

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

CVE-2026-102485

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

EUVD-2026-107311

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

CVE-2026-102485 Out-of-bounds Read in ntpsec

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control @@Gc reply with an out-of-range mode byte...

PT-2026-120641

Name of the Vulnerable Software and Affected Versions NTPsec ntpd versions prior to 1.2.6 Description An out-of-bounds read exists in the Motorola Oncore refclock driver. An attacker who controls the GPS receiver's serial data can cause the ntpd process to crash or disclose memory by sending a PP...

Astra Linux – vulnerability in libde265

LibDe265 is an open-source implementation of the h.265 video codec. Prior to version 1.0.17, a malformed H.265 PPS NAL unit caused a segmentation fault in picparameterset::setderivedvalues. This issue has been fixed in version 1.0.17...

SUSE CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

CVE-2026-97580

The Linux kernel contains a vulnerability in the rkvdec media driver where HEVC tile loops and PPS IDs were not properly bound to the array capacity. Specifically, the functions compute_tiles_uniform() and compute_tiles_non_uniform() looped over entries based on untrusted PPS data, and assemble_h...

CVE-2026-97580: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

PT-2026-98516

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Stateless HEVC decoders read entries from column width minus1 and row height minus1 based on the values of num tile columns minus1 + 1 and num tile rows minus1 + 1, using them as tile-lo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107328 advisory. In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-fre...

PT-2026-88518

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4 20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulati...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098674)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098674 advisory. In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-fre...

CVE-2026-45383

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...