CVE-2026-112062

The lwIP network stack (versions through 2.2.1 ) is vulnerable to a stack out-of-bounds write in the mdns_handle_response function. An adjacent attacker on the local link can exploit this by sending specially crafted mDNS responses during a service search—specifically, multicast PTR answers with ...

EUVD-2026-103504

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

EUVD-2026-103465

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-111678

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiwor...

EUVD-2026-102969

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiwor...

CVE-2026-111131

A flaw was found in libxmp. An attacker could exploit an off-by-one stack out-of-bounds read in the P61A depacker by convincing a user or service to process a specially crafted audio module file. Successful exploitation could lead to an application crash, resulting in a Denial of Service DoS, or...

PT-2026-116077

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiwor...

CVE-2026-111275

Versions of nifti_clib through 3.0.1 are vulnerable to a stack-based out-of-bounds read and write in the nifti_convert_n2hdr2nim() function. The root cause is a lack of range-checking on the NIfTI-2 dim[0] value. An attacker can provide a crafted 540-byte NIfTI-2 header via nifti_image_read() to ...

CVE-2026-111275 nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111161

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BWMidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adlopenFile or adlopenDa...

DEBIAN-CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111161

The libADLMIDI library, versions 1.6.2 through 1.6.2.1 , is vulnerable to an off-by-one stack out-of-bounds write within the BW_MidiSequencer component. An attacker can corrupt stack memory by providing a crafted MIDI file containing a note-on message with status 0x9F and note 0x7F . The vulnerab...

CVE-2026-111161 libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BWMidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adlopenFile or adlopenDa...

EUVD-2026-102288

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BWMidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adlopenFile or adlopenDa...

EUVD-2026-102281

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111131

The libxmp library, versions through 4.7.4 , contains an off-by-one stack out-of-bounds read vulnerability within the prowizard P61A depacker function, specifically located at depack_p61a() in src/loaders/prowizard/p61a.c. An attacker can exploit this by providing a crafted headerless P61A module...

CVE-2026-111131 libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111131 libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...