CVE-2026-37530: Stack-based Buffer Overflow

AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The senddiagnosticrequest function in uds.c allocates a 6-byte stack buffer MAXDIAGNOSTICPAYLOADSIZE=6 but copies up to 7 bytes MAXUDSREQUESTPAYLOADLENGTH=7 via memcpy at an offset of 1+pidlength 2-3...

CVE-2026-43037: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip4ip6err Oskar Kjos reported the following problem. ip4ip6err calls icmpsend on a cloned skb whose cb was written by the IPv6 receive path as struct inet6skbparm. icmpsend passes IPCBskb2 to...

EUVD-2026-26689

miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a 2016-10-05 contains a stack buffer overflow in senddiagnosticrequest. A 6-byte stack buffer MAXDIAGNOSTICPAYLOADSIZE=6 receives memcpy at offset 1+pidlength with payloadlength bytes. MAXUDSREQUESTPAYLOADLENGTH=7, so 1+2+7=10 exceeds...

Automotive-grade Linux agl-service-can-low-level security vulnerabilities

Automotive Grade Linux agl-service-can-low-level is an in-vehicle communication service component from Automotive Grade Linux. A security vulnerability exists in Automotive Grade Linux agl-service-can-low-level version 17.1.12 and earlier, which stems from an uds-c inventory overflow in the stack...

PT-2026-39345

HDF5 through 1.14.3 contains a stack buffer overflow in H5R decode heap, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

PT-2026-39339

HDF5 through 1.14.3 contains a stack buffer overflow in H5FL arr malloc, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

PT-2026-39343

HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HG read, resulting in denial of service or potential code execution...

Tenda HG3 buffer error vulnerability

The Tenda HG3 is a fiber-optic network terminal wireless router device designed for home broadband access by the Chinese company Tenda. Version 2.0 of the Tenda HG3 contains a buffer error vulnerability. This vulnerability stems from improper handling of the parameter destNet in the function...

mruby:mruby_fuzzer: Stack-buffer-overflow in first_set_walk

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4909069193510912 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x781f28ad31f8 Crash State:...

AZL-83825 CVE-2026-31630 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AFRXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port...

CVE-2026-31630: Stack-based Buffer Overflow

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AFRXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port...

PT-2026-36555

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504809218 Crash type: Stack-buffer-overflow READ Crash state: is http stun get message len str FuzzStunClient.c...

CVE-2026-40892

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsipauthcreatedigest2 in PJSIP when using pre-computed digest credentials PJSIPCREDDATADIGEST. The function copies credential data using credinfo-data.slen as the...

coturn:FuzzStunClient: Stack-buffer-overflow in is_http

Project: https://github.com/coturn/coturn.git Detailed Report: https://oss-fuzz.com/testcase?key=4778243818586112 Project: coturn Fuzzing Engine: libFuzzer Fuzz Target: FuzzStunClient Job Type: libfuzzerasancoturn Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

CVE-2026-40892: Stack-based Buffer Overflow

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsipauthcreatedigest2 in PJSIP when using pre-computed digest credentials PJSIPCREDDATADIGEST. The function copies credential data using credinfo-data.slen as the...

ogre:ogre_deep_fuzz: Stack-buffer-overflow in Ogre::MeshSerializerImpl::calcPosesSize

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=4777988268032000 Project: ogre Fuzzing Engine: afl Fuzz Target: ogredeepfuzz Job Type: aflasanogre Platform Id: linux Crash Type: Stack-buffer-overflow READ 8 Crash Address: 0x75121f264e18 Crash State...

CVE-2026-40489

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ecglob that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directo...

SAIL security vulnerabilities

SAIL is an open-source image decoding library developed by SAIL. SAIL has a security vulnerability, which stems from the RLE decoder in the TGA encoder/decoder’s asymmetric boundary checks. This vulnerability may lead to a stack buffer overflow...

K000160853: Multiple Vim vulnerabilities

Security Advisory Description CVE-2026-28417 Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an...

CVE-2026-40170

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransportparams serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport...