749 matches found
CVE-2026-117557
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
DEBIAN-CVE-2026-117557
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
CVE-2026-117557
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
CVE-2026-117557
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
UBUNTU-CVE-2026-117557
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
CVE-2026-117557 SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
CVE-2026-117557 SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
EUVD-2026-110835
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
CVE-2026-117557
The SDL_image library, specifically versions through 3.4.8 and 2.8.12 , contains a stack out-of-bounds read vulnerability within the IMG_LoadLBM_IO() function in src/IMG_lbm.c. The root cause is the failure to validate the bitplane count when HAM mode is enabled. An attacker can provide a special...
CVE-2026-117557
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
PT-2026-126416
SDL image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG LoadLBM IO in src/IMG lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...
SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4895-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4895-1 advisory. - CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142750)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142750 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the out...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143079)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143079 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the out...
CLSA-2026-1787935638 kernel: Fix of 164 CVEs
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds CVE-2023-53582 - net/sched: accept TCASTAB only for root qdisc CVE-2024-50039 - bpf, sockmap: Several fixes to bpfmsgpopdata CVE-2024-56720 - net: add more sanity checks to qdiscpktleninit CVE-2024-49948 -...
CVE-2026-90416
A flaw was found in the Linux kernel's RDMA/mlx5 component. The getparam function, used for debugging congestion parameters, incorrectly formats a 32-bit unsigned integer as a signed integer. This can lead to a stack out-of-bounds read when a large value is processed, potentially causing unexpect...
CVE-2026-76788
The Zephyr RTOS OSDP Control Panel reply parser contains a stack out-of-bounds write in cp_decode_response() within subsys/mgmt/osdp/src/osdp_cp.c. When processing REPLY_KEYPPAD or REPLY_RAW types, the parser fails to validate that the payload length stays within the fixed 64-byte OSDP_EVENT_MAX_...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...