EUVD-2026-78064

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-19542

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

CVE-2026-89020

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) is affected by a stack-based buffer overflow in the mtget binary's TFTP RRQ builder function. An authenticated user with read-only group membership can issue a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more ...

CVE-2026-89020 MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

OESA-2026-3804 file-roller security update

File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive. Security Fixes: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive...

OESA-2026-3806 file-roller security update

File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive. Security Fixes: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive...

OESA-2026-3805 file-roller security update

File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive. Security Fixes: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive...

OESA-2026-3803 file-roller security update

File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive. Security Fixes: A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive...

OESA-2026-3731 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

OESA-2026-3732 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

OESA-2026-3730 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

OESA-2026-3729 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in the GnuTLS library, specifically in the gnutlspkcs11tokeninit function, which handles PKCS11 token initialization. When a token label longer than expected is processed, the function writes beyond the end of a fixed-size stack buffer. This programming error can cause...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. The XkbSetMapChecks function declares a fixed-size stack buffer, mapWidths256, indexed by key type index. The helper function CheckKeyTypes writes to this buffer at a position controlled by the client,...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. The X server has multiple stack buffers with a size of XkbMaxShiftLevel XkbNumKbdGroups, but the CheckKeyTypes function does not verify or limit non-canonical key types to XkbMaxShiftLevel. A client can...

Astra Linux – Vulnerability in ncurses

The infocmp command-line tool in ncurses before version 6.5-20251213 has a stack-based buffer overflow in the analyzestring function in progs/infocmp.c...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

alsa-lib: alsa-lib: Denial of Service via off-by-one stack buffer overflow

A flaw was found in alsa-lib. This vulnerability is an off-by-one stack buffer overflow in the sndctlasciielemidparse function. A local attacker can exploit this by supplying a specially crafted, long control-element identifier string through saved state files or command-line arguments. This can...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11375)

Summary IBM MQ has addressed a stack buffer overflow vulnerability in the queue manager's XA transaction handling that could allow a remote authenticated attacker to execute arbitrary code by sending a crafted transaction identifier Vulnerability Details CVEID:CVE-2026-11375 DESCRIPTION: IBM MQ...

CVE-2026-90779

A flaw was found in SIPp. A malicious Session Initiation Protocol SIP server can exploit this by sending a specially crafted SIP authentication challenge with oversized algorithm parameters. This can lead to a stack buffer overflow in the createAuthHeader function, causing the client process to...