OESA-2026-2071 libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fixes: libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptpunpackCanonFE function in...

libvips:vips_fuzzer: Heap-buffer-overflow in JxlFastLosslessFrameState* AVX2::LLPrepare<AVX2::UpTo8Bits>

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=6029646226587648 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address:...

skcms:iccprofile_transform: Heap-buffer-overflow in skcms_private::baseline::clut

Project: https://skia.googlesource.com/skcms.git Detailed Report: https://oss-fuzz.com/testcase?key=4775888633004032 Project: skcms Fuzzing Engine: libFuzzer Fuzz Target: iccprofiletransform Job Type: libfuzzerasani386skcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

freerdp:TestFuzzNTLMMessage: Heap-buffer-overflow in ntlm_read_ChallengeMessage

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=6052045370228736 Project: freerdp Fuzzing Engine: honggfuzz Fuzz Target: TestFuzzNTLMMessage Job Type: honggfuzzasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

CVE-2026-34941 Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds chec...

CVE-2026-5441

An out-of-bounds read vulnerability exists in the DecodePsmctRle1 function of DicomImageDecoder.cpp within the Orthanc software. The PMSCT_RLE1 decompression routine, used to decode the proprietary Philips Compression format, fails to properly validate escape markers located near the end of the c...

kmime:kmime_fuzzer: Global-buffer-overflow in nameMatch

Detailed Report: https://oss-fuzz.com/testcase?key=6754501196578816 Project: kmime Fuzzing Engine: libFuzzer Fuzz Target: kmimefuzzer Job Type: libfuzzerasankmime Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x57c062f303e7 Crash State: nameMatch...

GHSA-588R-CR5C-W6HF OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Summary internalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic: c wavbuf += nx ny wcount; Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path...

CVE-2026-34608 nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB Read

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhookinproc.c, the hookworkcb function processes nng messages by parsing the message body with cJSONParsebody. The body is obtained from nngmsgbodymsg, which is a binary buffer without a...

sleuthkit:fls_ntfs_fuzzer: Heap-buffer-overflow in ntfs_proc_attrseq

Detailed Report: https://oss-fuzz.com/testcase?key=5542460911845376 Project: sleuthkit Fuzzing Engine: honggfuzz Fuzz Target: flsntfsfuzzer Job Type: honggfuzzasansleuthkit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7d1329be1481 Crash State: ntfsprocattrseq...

ghostscript:gs_pcl_fuzzer: Global-buffer-overflow in hpgl_stick_arc_width

Detailed Report: https://oss-fuzz.com/testcase?key=6027571291815936 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gspclfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Global-buffer-overflow READ 2 Crash Address: 0x5a0d3b97adc4 Crash State: hpglstickarcwidth...

CVE-2026-4732 Out-of-bounds Read Overflow in tildearrow/furnace

Out-of-bounds Read vulnerability in tildearrow furnace ‎extern/libsndfile-modified/src modules. This vulnerability is associated with program files flac.C‎. This issue affects furnace: before 0.7...

TencentOS Server 4: vim (TSSA-2026:0178)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0178 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

openssl:provider: Stack-buffer-overflow in DES_ede3_ofb64_encrypt

Project: https://github.com/openssl/openssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4954757063311360 Project: openssl Fuzzing Engine: libFuzzer Fuzz Target: provider Job Type: libfuzzerasanopenssl Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...

u-boot:fuzz_fit_image_load: Heap-buffer-overflow in fdt_check_full

Detailed Report: https://oss-fuzz.com/testcase?key=5208350320295936 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzfitimageload Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7898b90e750c Crash State: fdtcheckfull fitcheckform...

u-boot:fuzz_image_decomp: Heap-buffer-overflow in lzmaBuffToBuffDecompress

Detailed Report: https://oss-fuzz.com/testcase?key=5019466785423360 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzimagedecomp Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7726fc3e00b6 Crash State: lzmaBuffToBuffDecompress...

llvm:clangd-fuzzer: Global-buffer-overflow in _GLOBAL__sub_I_DependencyScanningTool.cpp

Detailed Report: https://oss-fuzz.com/testcase?key=5886579209207808 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clangd-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Global-buffer-overflow READ Crash Address: 0x5759a2773a02 Crash State:...

dnsmasq:fuzz_util: Stack-buffer-overflow in hostname_issubdomain

Detailed Report: https://oss-fuzz.com/testcase?key=4674902966992896 Project: dnsmasq Fuzzing Engine: libFuzzer Fuzz Target: fuzzutil Job Type: libfuzzerasandnsmasq Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7b6af7ad017f Crash State: hostnameissubdomain fuzzutil.c...

Oracle Linux 7 : kernel (ELSA-2026-1581)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1581 advisory. - e1000e: fix heap overflow in e1000seteeprom CVE-2025-39898 Orabug: 38904071 - i40e: fix idx validation in config queues msg CVE-2025-39971 Orabug:...

UBUNTU-CVE-2026-29022

drlibs drwav.h version 0.14.4 and earlier fixed in commit 8a7258c contain a heap buffer overflow vulnerability in the drwavreadsmpltometadataobj function of drwav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 a...