178303 matches found
PT-2026-98072
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ntfs3 driver where a malformed NTFS directory index entry can specify a key size larger than the actual bytes present in its NTFS DE payload. During directory...
CVE-2026-26054: Out-of-bounds Read
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...
PT-2026-104921
In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer...
CVE-2026-97433: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer...
CVE-2026-97433
In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer...
CVE-2026-93806
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211rxassocresp initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is...
CVE-2026-93793
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TXCMD response layout TXCMD parsing uses framecount to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing...
CVE-2026-93281: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
CVE-2026-93281
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
EUVD-2026-86284
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...
PT-2026-104934
In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw rx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...
CVE-2026-97438: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds BUG A malformed NTFS directory index entry can advertise a keysize larger than the bytes actually present in its NTFSDE payload. Directory lookup then passes that malformed key to...
CVE-2026-88358
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...
CVE-2026-93541
An out-of-bounds read in libXi's XQueryDeviceState in libXi before 1.8.4 could be used by a...
PT-2026-98031
Name of the Vulnerable Software and Affected Versions libXi versions prior to 1.8.4 Description An out-of-bounds read occurs during class parsing within the XListInputDevices function. This flaw allows a malicious X server to cause a crash of an attached X client. An out-of-bounds read is a...
PT-2026-98067
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme component where FDP Flexible Data Placement configuration descriptor sizes are not properly validated. When walking the FDP configurations log, a dsze value o...
PT-2026-98062
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component regarding the parsing of Field Replaceable Unit FRU Product Information Area PIA data. The original implementation used an open-coded...
CVE-2026-93542
An out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses in libXi before 1.8.4 could be used by malicous servers to crash the X client...