Google Chrome Vulnerability: CVE-2026-113193

Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read via incorrect row size calculation for P;2L and P;4L raw decode modes in RawDecode.c and decode.c. When decoding images using these bit-plane palette raw modes, the buffer size is computed using pixel-based bit arithmet...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read via the decodeStrip and decodeTile functions in src/libImaging/TiffDecode.c, where the TIFF strip and tile decode buffers are reallocated without zeroing the region beyond previously decoded data. When a codec such as...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the TIFF image encoder in TiffImagePlugin.py and src/encode.c, where the ColorMap length is not validated against the BitsPerSample tag value. Prior to the fix, the encoder hardcoded a requirement of 768 entries...

SUSE CVE-2026-98485

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

SUSE CVE-2026-98578

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

SUSE CVE-2026-98582

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

SUSE CVE-2026-112009

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashe...

SUSE CVE-2026-112052

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

SUSE CVE-2026-112053

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

SUSE CVE-2026-112055

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

SUSE CVE-2026-112056

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

SUSE CVE-2026-112057

libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnavdescribetitlechapters that allows attackers to read beyond the part-of-title array by supplying an oversized vtsttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vtsttn than t...

SUSE CVE-2026-112058

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with titl...

SUSE CVE-2026-112073

A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmultransb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely...

SUSE CVE-2026-112271

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to...

SUSE CVE-2026-112272

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file...

SUSE CVE-2026-112273

libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::composename in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority...

SUSE CVE-2026-112274

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soarecord::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causin...

SUSE CVE-2026-112277

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs o...