SUSE CVE-2026-98631

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

SUSE CVE-2026-98687

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

SUSE CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

SUSE CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

SUSE CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

SUSE CVE-2026-101201

A malformed header in the binary file fed to QBinaryJson::fromBinaryData can cause undefined behaviour because of out-of-bounds read...

SUSE CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

SUSE CVE-2026-112276

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent...

SUSE CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-113095

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the Focus component allows a remote attacker to execute arbitrary code within the browser's restricted environment sandbox. By convincing a user to visit a specially crafted HTML page, an attacker can trigger this memory...

DEBIAN-CVE-2026-112202

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the image are used without checking the colour table's bounds. The ireadgiflow routine reads beyond the heap allocation and copies the bytes into...

CVE-2026-112202

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the image are used without checking the colour table's bounds. The ireadgiflow routine reads beyond the heap allocation and copies the bytes into...

CVE-2026-112202

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the image are used without checking the colour table's bounds. The ireadgiflow routine reads beyond the heap allocation and copies the bytes into...

UBUNTU-CVE-2026-112202

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the image are used without checking the colour table's bounds. The ireadgiflow routine reads beyond the heap allocation and copies the bytes into...

CVE-2026-113329

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the installer component allows a remote attacker to read process memory inside the sandbox environment. By enticing a user to open a specially crafted HTML page, an attacker could exploit this flaw to disclose unauthoriz...

CVE-2026-113310

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the Bluetooth component allows a remote attacker to read memory within the sandbox by enticing a user to view a crafted HTML page. This issue leads to unauthorized information disclosure from within the sandboxed...

CVE-2026-113050

An out of bounds read flaw was found in the HID component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=562655586 https://code.google.com/p/chromium/issues/detail?id=113050...

CLSA-2026-1792537208 libevent: Fix of 5 CVEs

CVE-2026-63383: fix out-of-bounds read in decodetaginternal - CVE-2026-63384: reject payload lengths above INTMAX in evtagunmarshalheader - CVE-2026-63387: fix off-by-one stack buffer overflow in dnsnametolabels - CVE-2026-63385: reject HTTP header values containing CR or LF - CVE-2026-63382:...

CLSA-2026-1792536579 libevent: Fix of 5 CVEs

CVE-2026-63383: fix out-of-bounds read in decodetaginternal - CVE-2026-63384: reject payload lengths above INTMAX in evtagunmarshalheader - CVE-2026-63387: fix off-by-one stack buffer overflow in dnsnametolabels - CVE-2026-63385: reject HTTP header values containing CR or LF - CVE-2026-63382:...

EUVD-2026-106871

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the image are used without checking the colour table's bounds. The ireadgiflow routine reads beyond the heap allocation and copies the bytes into...