CVE-2026-98602

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...

CVE-2026-98612

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

Linux Distros Unpatched Vulnerability : CVE-2026-112056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by...

PT-2026-117421

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process plane in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs ...

PT-2026-117417

libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authorit...

PT-2026-117422

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process raw bmpcache in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy to read pas...

PT-2026-117664

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the PSD thumbnail resource loader that performs a BGR-to-RGB channel swap using a fixed 3-byte stride without verifying if the JPEG thumbnail is RGB. A specially crafted graysca...

PT-2026-117423

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process bmpcache2 in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble a...

Red Hat: CVE-2026-112257: gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...

CVE-2026-112279: Out-of-bounds Read

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processbmpcache2 in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble an...

CVE-2026-112277: Out-of-bounds Read

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs o...

CVE-2026-112278: Out-of-bounds Read

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processrawbmpcache in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy to read past...

CVE-2026-112273: Out-of-bounds Read

libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::composename in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority...

CVE-2026-112274: Out-of-bounds Read

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soarecord::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causin...

UBUNTU-CVE-2026-98732

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintelhwerror The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s" a...

CVE-2026-98582

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98578

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

CVE-2026-98576

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...