CVE-2026-111126

A flaw was found in catdoc. An out-of-bounds read vulnerability exists in the spreadsheet parsing logic of the xls2csv utility. By convincing a user to process a specially crafted Excel file, an attacker could trigger memory reads beyond the allocated buffer boundaries. This issue primarily leads...

CVE-2026-110877

A flaw was found in AdPlug. By convincing a user to open a specially crafted, truncated TwinTeam DMO file, an attacker can trigger an out-of-bounds read in the CdmoLoader::load function. This issue causes the application to crash, resulting in a Denial of Service DoS...

EUVD-2026-102856

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958

A flaw in spice-server allows an authenticated SPICE client to perform out-of-bounds read and write operations during VM live migration. The vulnerability exists because multiple migration data handlers fail to perform bounds validation on client-supplied offsets from SPICE_MSGC_MIGRATE_DATA mess...

CVE-2026-105958

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

OESA-2026-4408 cups security update

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol IPP to support printing to local and network printers.. Security Fixes: The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a...

OESA-2026-4391 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...

OESA-2026-4390 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...

OESA-2026-4389 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: SoupAuthManager caches proxy authentication credentials without scoping them to...

RUSTSEC-2026-0396 `Seekable` reads a NULL or out-of-bounds seek table

Seekable did not record whether it was initialized. On a fresh Seekable, or one whose initbuff failed, decompress, offsettoframeindex and framedecompressedsize made the C library read a NULL seek table. After a failed re-initialization, decompress returned data from the refused buffer using the...

RUSTSEC-2026-0393 Out-of-bounds read when training a dictionary from inconsistent sample sizes

ZDICTtrainFromBuffer is never told the length of the samples buffer. Before 0.4.10, zstd::dict::fromcontinuous initially traindict called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off,...

Out-of-bounds read in `train_from_buffer` when sample sizes overflow

ZDICTtrainFromBuffer is never told the length of the samples buffer, so trainfrombuffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the...

RUSTSEC-2026-0405 Out-of-bounds read with an out-of-range `InBuffer::pos`

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTDseekablecompressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and...

`Seekable` reads a NULL or out-of-bounds seek table

Seekable did not record whether it was initialized. On a fresh Seekable, or one whose initbuff failed, decompress, offsettoframeindex and framedecompressedsize made the C library read a NULL seek table. After a failed re-initialization, decompress returned data from the refused buffer using the...

Out-of-bounds read with an out-of-range `InBuffer::pos`

InBuffer's fields are public, so safe code can set pos past the end of src. The position was passed to the C library unchecked, and ZSTDseekablecompressStream, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and...

RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow

ZDICTtrainFromBuffer is never told the length of the samples buffer, so trainfrombuffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the...