1113 matches found
CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...
CVE-2026-107733
In SumatraPDF version 3.6.1 and earlier for Windows, a null-pointer dereference occurs within the FrameOnCommand() function when handling CmdExec while no document tab is open. The root cause is the passing of a null current-tab pointer to RunWithExe(), leading to the dereferencing of WindowTab::...
CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...
DEBIAN-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
UBUNTU-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
EUVD-2026-95254
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106431
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
EUVD-2026-95152
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
CVE-2026-106431
The MongoDB C Driver contains a one-byte heap buffer overflow in the BSON bulk document writer . An off-by-one error allows a zero byte to be written past a heap allocation when a document ends at a specific buffer boundary. This vulnerability can lead to process memory corruption or a process te...
CVE-2026-106431
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
CVE-2026-105825 ImageMagick before 7.1.2-30 Denial of Service via Crafted XMP Profile
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a denial of service vulnerability in its handling of XMP profiles, where a crafted profile terminates the process instead of raising an exception. Attackers can supply images with malicious XMP profiles to crash applications that proce...
CVE-2026-107733: NULL Pointer Dereference
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...
CVE-2026-107737: Improper Validation of Array Index
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...
CVE-2026-106431: Out-of-bounds Write
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
CVE-2026-106435: Out-of-bounds Read
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...