CVE-2026-116739

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-117557

A flaw was found in SDLimage. By tricking a user or application into processing a specially crafted Interleaved Bitmap ILBM image file, an attacker can trigger an out-of-bounds read condition during image decoding. This can lead to a Denial of Service DoS by causing the application to crash, or...

CVE-2026-99031

A flaw was found in the Linux kernel's network bridge subsystem. When cleaning up multicast port entries, the kernel executes recursive function calls that consume a new stack frame for each port being removed. An attacker capable of triggering the removal of a large number of multicast ports can...

CVE-2025-5777

CVE-2025-5777 Citrix NetScaler Memory Leak Exploit !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this script...

CVE-2026-116586

A flaw was found in go-jose. A remote attacker could cause a Denial of Service DoS by submitting specially crafted, deeply nested JSON JavaScript Object Notation input to an affected application. When parsing these deeply nested arrays or objects, the system exceeds its stack memory limits,...

CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

SUSE CVE-2026-116739

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

DEBIAN-CVE-2026-117557

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117557 SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

EUVD-2026-110487

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116739

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116741

The Speex (libspeex) library, versions through 1.2.1 , is vulnerable to an out-of-bounds write in the speex_bits_read_whole_bytes() function located in libspeex/bits.c. The root cause is the incorrect handling of length truncation for non-owned SpeexBits buffers . An attacker can exploit this by ...

CVE-2026-116741 Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116741 Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116739

VMime versions through 0.9.2 are vulnerable to an information disclosure flaw within the uuEncoder::decode function. The root cause is the writing of uninitialized stack memory into decoded output when processing over-long lines. An attacker can exploit this by sending a crafted uuencode or x-uue...

CVE-2026-116739 VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116739 VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116739

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-81038

The Bluetooth Object Transfer Service (OTS) server is vulnerable to an uninitialized stack memory disclosure or denial of service via the Object Action Control Point (OACP). The flaw exists in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c), where the net_buf_simple_pull_le32()function...

CVE-2026-81038 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...