EUVD-2026-117648

NEURON CoreNEURON through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcoremech.dat, globals.dat, or files.dat loaded...

EUVD-2026-117644

eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in getattributes in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more characters to corrupt the stack and crash...

CVE-2026-116571

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtp2rtmpH264 built an AVC decoder configuration record in a fixed stack buffer by copying...

CVE-2026-116567

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmphandlecontrol rendered an RTMP user-control message into a 200-byte stack buffer using an...

CVE-2026-115928

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switchcoremediaaddcrypto passed the encoded key and salt length from an inbound SDP a=crypto...

CVE-2026-116567

Prior to version 1.11.2 , FreeSWITCH is vulnerable to a pre-authentication stack buffer overflow in the mod_rtmp module. The vulnerability exists in the rtmp_handle_control() function, where an unbounded sprintf loop renders an RTMP user-control message into a 200-byte stack buffer. An attacker c...

CVE-2026-116571

The FreeSWITCH telecom stack contains a stack buffer overflow in the mod_rtmp module, specifically within the rtmp_rtp2rtmpH264() function. The vulnerability occurs because the software copies wire-derived SPS and PPS values into a fixed stack buffer without verifying that the sizes and framing f...

CVE-2026-116570

FreeSWITCH versions prior to 1.11.2 are vulnerable to a pre-authentication stack buffer overflow within the http_directory_auth() function of the mod_xml_rpc module. The root cause is an encoder that fails to check output length when base64-encoding a user@domain:password credential into an 80-by...

CVE-2026-116572 FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in modsofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and...

CVE-2026-116572

The FreeSWITCH telecommunications platform (versions 1.10.0 to 1.11.1 ) contains a stack-based buffer overflow in the mod_sofia component. The root cause is the insufficient handling of SIP Contact display names during dialog-event notifications. An attacker can provide an excessively long displa...

CVE-2026-115928

Prior to version 1.11.2 , FreeSWITCH is vulnerable to a stack buffer overflow when parsing the SDP a=crypto attribute on inbound calls. The root cause is located in the switch_core_media_add_crypto() function, where passing a zero-length key and salt from the attribute causes an integer underflow...

CVE-2026-116573

The open-source telecommunications platform FreeSWITCH versions 1.10.0 through 1.11.1 is vulnerable to a stack-based buffer overflow in the mod_sofia component. The flaw occurs when generating dialog-event notifications; a peer can provide an excessively long SIP To-header user part and subscribe...

CVE-2026-116573 FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in modsofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that...

CVE-2026-123203

The NEURON (CoreNEURON) simulator, versions through 9.0.2 , is vulnerable to a stack-based buffer overflow (CWE-121). The root cause occurs when nrniv-core loads a crafted model dataset containing over-long version or mechanism-name tokens within the bbcore_mech.dat, globals.dat, or files.dat fil...

CVE-2026-123200

VRPN versions through 07.36 are vulnerable to an out-of-bounds stack write in the vrpn_Endpoint::handle_sender_message() and handle_type_message() functions. The root cause is an unchecked length index used during the processing of SENDER_DESCRIPTION or TYPE_DESCRIPTION messages. This vulnerabili...

CVE-2026-123151

A flaw was found in the GNU debugger GDB. When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with...

CVE-2026-121994

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetchregisterusingp, which decodes a stub's register reply into an alloca-sized buffer without bounding writes b...

CVE-2026-121995

A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffe...

CTFs

CTF Writeups Hey there, I'm Sean and I enjoy doing CTF problems in my spare time. My current position has me doing a lot of binary exploitation and software reverse engineering so I tend to focus on those categories. Most writeups that I see online suck and I hope these do a better job explaining...

CVE-2026-12485

🚨 CVE-2026-12485 - Critical Unauthenticated Remote Code Execution RCE GeoVision GV-I/O Box 4E – Firmware v2.09 Disclosure Date: June 23, 2026 CWE: CWE-121 – Stack-Based Buffer Overflow Attack Vector: Network Unauthenticated An unauthenticated stack-based buffer overflow vulnerability in the...