CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

CVE-2026-112055

The wvWare wv library through version 1.2.9 contains a stack-based out-of-bounds read vulnerability in the wvGetPAPX_FKP and wvGetCHPX_FKP functions. The root cause is an unvalidated FKP run count , which allows an attacker to supply a crafted .doc file containing a large crun value. This can cau...

CVE-2026-112055

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

EUVD-2026-103517

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

EUVD-2026-103515

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

CVE-2026-112053

The libschroedinger library (versions through 1.0.11 ) is vulnerable to an out-of-bounds read in the schro_params_set_default_quant_matrix function. The root cause is the failure to validate wavelet filter index or transform depth values, allowing an attacker to read past a static quantiser table...

CVE-2026-112053 Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

CVE-2026-112053 Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

CVE-2026-112053

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filte...

CVE-2026-112052

Versions of libspatialite through 5.1.0 are vulnerable to an integer overflow within the WKB point and vertex count size guard of the ParseWkbLine and related parsers in gg_wkb.c . An attacker can provide a specially crafted geometry BLOB—such as one within a SpatiaLite database file —containing ...

EUVD-2026-103514

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112052

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112052 libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112052 libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing

libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in ggwkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite...

CVE-2026-112020

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepngutil.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

CVE-2026-112019

cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...

DEBIAN-CVE-2026-112009

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashe...

CVE-2026-112009

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashe...