SUSE CVE-2026-111141

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central...

SUSE CVE-2026-111142

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing...

SUSE CVE-2026-111143

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer...

SUSE CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

SUSE CVE-2026-111149

FreeImage danoli3 fork through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to...

SUSE CVE-2026-111158

EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3detect in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2ISVALIDHEADER to msr3parse or ms3detect, over-reading up to 8 bytes and...

SUSE CVE-2026-111162

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...

SUSE CVE-2026-111163

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in WMParseNewHmi in src/fhmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation,...

SUSE CVE-2026-111165

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

SUSE CVE-2026-111166

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMFLoad loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex...

SUSE CVE-2026-111271

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

SUSE CVE-2026-111375

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon...

SUSE CVE-2026-111376

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer...

CVE-2026-110876

A flaw was found in AdPlug. An attacker could exploit this vulnerability by providing a specially crafted XSM audio file to be processed by the application. Due to insufficient bounds checking when handling note data, playing the malicious file triggers an out-of-bounds read memory error. This...

CVE-2026-111126

A flaw was found in catdoc. An out-of-bounds read vulnerability exists in the spreadsheet parsing logic of the xls2csv utility. By convincing a user to process a specially crafted Excel file, an attacker could trigger memory reads beyond the allocated buffer boundaries. This issue primarily leads...

CVE-2026-110877

A flaw was found in AdPlug. By convincing a user to open a specially crafted, truncated TwinTeam DMO file, an attacker can trigger an out-of-bounds read in the CdmoLoader::load function. This issue causes the application to crash, resulting in a Denial of Service DoS...

EUVD-2026-102856

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958

A flaw in spice-server allows an authenticated SPICE client to perform out-of-bounds read and write operations during VM live migration. The vulnerability exists because multiple migration data handlers fail to perform bounds validation on client-supplied offsets from SPICE_MSGC_MIGRATE_DATA mess...

CVE-2026-105958

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...