CVE-2026-110606 LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110606

The libdxfrw library used in LibreCAD (versions through LC2.2.0 , which includes LibreCAD through 2.2.1.5 ) is vulnerable to a stack-based out-of-bounds read in the dwgReader18::readFileHeader() function. The root cause is the improper use of strlen on buffers that are not NUL-terminated . An att...

CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110598 Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110598

The Libyal libpff library (through version 20260926) contains an integer underflow vulnerability within the libpff_record_entry_get_multi_value() function. This flaw allows an attacker to trigger heap out-of-bounds reads by providing non-monotonic multi-value offsets. Specifically, by crafting PS...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110598 Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110597

Tinyexr versions through 3.2.0 are vulnerable to a heap out-of-bounds read in the ParseEXRMultipartHeaderFromMemory() function. The root cause is a stale remaining-size value that allows a crafted multi-part EXR file to bypass ReadAttribute() bounds checks. This can result in an application crash...

EUVD-2026-101225

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

EUVD-2026-101226

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

EUVD-2025-211089

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

EUVD-2024-55799

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392

PhysicsFS versions through 3.2.0 are vulnerable to an out-of-bounds read in the __PHYSFS_utf8codepoint() function. The root cause is an off-by-one cursor advance occurring when processing six-octet UTF-8 sequences . An attacker can provide a crafted archive containing entry names ending in these ...

CVE-2024-58392 PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392 PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

K000162610: NGINX Gateway Fabric vulnerability CVE-2026-96615

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticate...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...