ROS-20261021-73-0025

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

RockyLinux 8 : perl-DBI:1.641 (RLSA-2026:85916)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

CVE-2025-71438

An out-of-bounds read vulnerability exists in the gf_odf_ac4_cfg_dsi_v1 function (located in /odf/descriptors.c) of the GPAC Project/MP4Box software before version v26.07.0 . An attacker can exploit this flaw by providing a crafted AC4 file to trigger a Denial of Service (DoS) . While the vulnera...

GPAC MP4Box security vulnerability

A security vulnerability exists in GPAC MP4Box versions prior to 26.07.0. This vulnerability stems from an out-of-bounds read in the gfodfac4cfgdsiv1 function located at /odf/descriptors.c, which may allow attackers to cause a denial of service by providing a specially crafted AC4 file...

Red Hat: CVE-2026-114038: device-mapper-multipath: device-mapper-multipath: Information disclosure via malformed format string

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure...

PT-2026-120167

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.1 Description On Windows, a heap out-of-bounds read occurs in the client cli present gateway message function when a byte count is passed as wide-character printf precision. A malicious RD Gateway can trigger thi...

Metasploit Framework iOS Image Gather Path Traversal

Metasploit Framework contains a path traversal in the iOS image gather module that allows a hostile Meterpreter agent to write files on the operator workstation and execute code when msfconsole is started. https://packetstorm.news/download/236750...

PT-2026-135250

Out-of-bounds read in Recursor findScopeZero...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform version 4, contain a buffer error vulnerability. This vulnerability stems from the multipath daemon in device-mapper-multipath failing to properly handle format strings ending with a percent sign...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792599160)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792599160 advisory. - A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated...

RockyLinux 9 : openexr (RLSA-2026:86983)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86983 advisory. openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-34544 openexr: OpenEXR: Denial of Service or...

RHEL 9 : openexr (RHSA-2026:86983)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86983 advisory. OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libXi (UTSA-2026-142326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142326 advisory. An out-of-bounds read in libXi's XListInputDevices class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. Tenable ha...

RockyLinux 9 : tftp (RLSA-2026:80663)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80663 advisory. tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine CVE-2026-85234 Tenable has extracted the preceding description block directly...

ROS-20261021-73-0064

The vulnerability of the TSMF decoder in FFmpeg’s RDP client, FreeRDP, relates to reading data outside of the allowed range in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

openFPGALoader Parser Function Unauthorized Access

The vulnerability of the POFParser::parseSection function in the openFPGALoader library lies in the reading of data beyond the allowed range during the parsing of a specially created .pof file. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

ANGLE Library Protected Information Access

The ANGLE library vulnerability in Google Chrome and Microsoft Edge is related to reading data beyond the permissible buffer boundaries. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

PT-2026-120531

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

PT-2026-120569

The Discovery naming-service reply parser in Apache bRPC versions 1.18.0 calls RapidJSON object-only accessors FindMember on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries...

PT-2026-120545

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra stream id for every additional stream. The response...