CVE-2025-5777

CVE-2025-5777 Citrix NetScaler Memory Leak Exploit !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this script...

CVE-2026-98413

A flaw was found in the Linux kernel's SELinux Security-Enhanced Linux subsystem. When an access check is performed with an empty permission set, the Access Vector Cache AVC fails to initialize the access decision structure before returning. A local attacker can exploit this flaw by triggering...

EUVD-2026-102530

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111275

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

DEBIAN-CVE-2026-111131

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111131

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111154 libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111154

The libTiMidity library, through version 0.2.8 , is vulnerable to a stack out-of-bounds write in the SoundFont loader. The root cause is located in the parse_gen function, where unchecked generator operators allow for the processing of out-of-range pgen/igen operator values. By supplying a crafte...

CVE-2026-111131 libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

EUVD-2026-102362

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111131

The libxmp library, versions through 4.7.4 , contains an off-by-one stack out-of-bounds read vulnerability within the prowizard P61A depacker function, specifically located at depack_p61a() in src/loaders/prowizard/p61a.c. An attacker can exploit this by providing a crafted headerless P61A module...

CVE-2026-111131 libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

PT-2026-115137

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack p61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into samp...

PT-2026-115267

nifti clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti convert n2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti image read to crash applications or corrupt stack memo...

PT-2026-115160

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

PT-2026-115129

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-109438

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

EUVD-2026-101290

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

CVE-2026-109438

Versions 0.9.7 through 1.0.1 of 3proxy are vulnerable to an uninitialized stack memory disclosure vulnerability. When the external-NAT option (-Ne) is configured, unauthenticated attackers can send a client probe that fails the SOCKS version check. This triggers a SOCKS4 reply containing uninitia...

CVE-2026-109438 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...