CVE-2026-54913 WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. Prior to 2.4.5, loadinitexpr in core/iwasm/interpreter/wasmloader.c accepts a non-reference heap-type byte for ref.null when WASMENABLEGC=0, while the local WASMValue curvalue union is not zero-initialized and...

CVE-2026-54913

The WebAssembly Micro Runtime (WAMR) runtime contains a vulnerability prior to version 2.4.5 in the load_init_expr function of core/iwasm/interpreter/wasm_loader.c. When WASM_ENABLE_GC=0, the runtime fails to properly validate the ref.null heap-type byte. Because the local WASMValue union is not ...

CVE-2026-121505 Out-of-bounds Read in NTPsec

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

CVE-2026-121505

NTPsec versions before 1.2.4 are vulnerable to an out-of-bounds read in the nts_client_process_response_core function of the NTS-KE client response parser. A malicious NTS-KE server can trigger this by sending a record where the declared length exceeds the actual data received. This allows the se...

CVE-2026-121505: NTPsec: An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4…

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

SUSE CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

SUSE CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

DEBIAN-CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

DEBIAN-CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

CVE-2026-120246

A flaw was found in FFmpeg. This vulnerability leads to information disclosure when processing a specially crafted CDXL media file. By tricking a user or automated service into decoding a file that references uninitialized color palette entries, an attacker can cause sensitive internal stack memo...

EUVD-2026-114743

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120246 FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120243

Versions 2.0 through 9.0.2 of FFmpeg are vulnerable to a use of uninitialized variable in the Go2Meeting decoder . By crafting a G2M3/G2M4 stream with a short Kempf palette, an attacker can trigger the kempf_restore_buf() function to copy uninitialized stack bytes—potentially including pointers o...

CVE-2026-120243 FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

EUVD-2026-114740

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...