190235 matches found
CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...
EUVD-2026-105042
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...
CVE-2026-91059
The GUIX JPEG software decoder is vulnerable to an out-of-bounds read (CWE-125) because it does not enforce ordering on JPEG markers. A crafted file containing a second SOF0 frame header after an SOS marker causes the decoder to re-run the frame header parser after the output buffer is already al...
CVE-2026-91059
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second "SOF0" frame header after "SOS" re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns "GXSUCCESS" and publishes a "GXPIXELMAP...
CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92446
The GUIX binary resource loader contains an out-of-bounds read vulnerability within the gx_binres_theme_load() and gx_binres_font_load() functions. The root cause is that these functions accept resources as a bare GX_UBYTE * without a length, and the GX_BINRES_DATA_INFO structure lacks a field to...
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
EUVD-2026-105037
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
EUVD-2026-105027
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...
CVE-2026-95111 Module queue front-send validates a word count as a byte count
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...
CVE-2026-95111
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's "txqueuemessagesize" is a count of "ULONG"s and the co...
CVE-2026-95111 Module queue front-send validates a word count as a byte count
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...
CVE-2026-95111
The ThreadX RTOS contains a vulnerability where the front-send dispatcher incorrectly validates a word count as a byte count. Specifically, when a memory-protected module requests a queue operation, the dispatcher fails to multiply the tx_queue_message_size by the size of a ULONG. This allows _tx...
CVE-2026-95111 Module queue front-send validates a word count as a byte count
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...
CLSA-2026-1792506549 compat-openssl11: Fix of CVE-2026-84782
CVE-2026-84782: fix out-of-bounds read in DTLS retransmission caused by a stale initoff left behind by a suspended write...
CVE-2026-96582
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...
DEBIAN-CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...
CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...