501 matches found
CVE-2026-41257 jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB via deeply nested generator forks, the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for ...
Linux kernel 安全漏洞
The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the possibility of attempting to reallocate excess pages during page reallocation in afalgpulltsg...
JLSEC-2026-380
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation...
Linux kernel 安全漏洞
The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the use of the virtwifi device to reallocate memory after release. This could lead to access to...
The vulnerability of the amdgpu_amdkfd_gpuvm_acquire_process_vm() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c file of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the amdgpuamdkfdgpuvmacquireprocessvm function in the drivers/gpu/drm/amd/amdgpu/amdgpuamdkfdgpuvm.c file of the Linux kernel is related to the reallocation of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...
PT-2026-51887
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free flaw exists in the Transparent Inter-Process Communication TIPC module. The issue occurs within the tipc buf append function when it incorrectly handles memory after a sock...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013749)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013749 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: Fix DMA mappings leak During reallocation of RX buffers, new DMA mappings are created for...
CLSA-2026-1773928447 expat: Fix of CVE-2026-25210
CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent function...
The vulnerability of the Windows operating system’s kernel, which allows a hacker to increase their privileges
The vulnerability of the Windows operating system’s kernel is related to a memory reallocation error. Exploiting this vulnerability can allow an attacker to increase their privileges...
PT-2026-44314
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 Description An out-of-bounds font access occurs in the fbcon rotate font function when console rotation fails. The system retains the ol...
CVE-2026-33987
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A memory corruption vulnerability exists in the persistent cache handling. If a memory reallocation fails, an internal size variable is incorrectly updated, while the data pointer still refers to the original,...
SUSE CVE-2026-33986
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...
CVE-2026-33987 FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistentcachereadentryv3 in libfreerdp/cache/persistent.c, persistent-bmpSize is updated before winpralignedrecalloc. If realloc fails, bmpSize is inflated while bmpData points to the old buffer. This...
EUVD-2026-17233
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...
The vulnerability of the acpi_ut_copy_ipackage_to_ipackage() function in the driver/acpi/acpica/utcopy.c file of the ACPI driver for the Linux kernel’s Extended Configuration and Power Management interface allows a malicious actor to cause a system failure.
The vulnerability of the acpiutcopyipackagetoipackage function in the driver/acpi/acpica/utcopy.c file of the ACPI driver an extended configuration and power management interface for the Linux kernel is related to the reallocation of previously freed memory. Exploiting this vulnerability could...
The vulnerability of the dpll_device_unregister() function in the drivers/dpll/dpll_core.c module of the DPLL driver support library in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the dplldeviceunregister function in the drivers/dpll/dpllcore.c module of the Linux DPLL driver framework is related to a error in re-allocating previously released memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
CLSA-2026-1774283473 Fix CVE(s): CVE-2026-25210
SECURITY UPDATE: Improve determination of buffer size bufSize in function doContent - debian/patches/CVE-2026-25210.patch: fix integer overflow in doContent tag buffer reallocation - CVE-2026-25210...
expat: Fix of CVE-2026-25210
CVE-2026-25210: fix memory corruption via integer overflow in doContent function during tag buffer reallocation...