CVE-2026-91752 GNU libextractor before 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Freeciv vulnerability (USN-8754-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8754-1 advisory. It was discovered that Freeciv incorrectly handled certain network packets, resulting in a stack overflow. A remote attacker...

PT-2026-91773

Name of the Vulnerable Software and Affected Versions GNU libextractor versions prior to 1.15 Description A stack-based buffer overflow occurs in the process star office function. The issue arises when the function determines the size of a variable-length stack array using attacker-controlled OLE...

PT-2026-91879

First CVE IDs are in — MITRE assigned 10 CVEs to our research CVE-2026-88557 → 88566. All 10 were found, verified end-to-end, and disclosed first by our AI-driven research pipeline. Every single one ships a full root-cause analysis and a working, reproducible PoC — public since day one, no...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:4128-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4128-1 advisory. This update for php7 fixes the following issue: - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. Tenable has...

CVE-2026-54333

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54559 PocketSphinx: Buffer overflows in language and acoustic model loading code

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded...

CVE-2026-89020

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

CVE-2026-89020 MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path

MikroTik RouterOS before 7.23.4 long-term and 7.24.2 stable contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch comman...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-53752

docx4j , an open-source Java library for OpenXML processing, is vulnerable to a denial of service via a cyclic w:basedOn style inheritance chain. In versions prior to 11.5.14 , PropertyResolver.fillPPrStack and adjacent helpers recurse through style inheritance without cycle detection. A well-for...

CVE-2026-19542

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

CVE-2026-19542 Stack-based out-of-bounds write in tdelete during tree rebalancing

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as...

Astra Linux – Vulnerability in usbutils

The vulnerability of the readlinkrecursive function in the USBUtils utility is related to buffer overflow on the stack. Exploiting this vulnerability could allow an attacker to cause a system failure...

Astra Linux – Vulnerability in ORC

A stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked into processing a specially crafted file using the affected ORC compiler, arbitrary code may be executed on the developer’s build environment. This may lead to compromise of...

Astra Linux – Vulnerability in u-boot

The U-Boot versions from 2016.09 to 2019.07-rc4 can memset too much data while reading a crafted ext4 filesystem. This results in a stack buffer overflow, potentially leading to code execution...

Astra Linux – Vulnerability in ICU

A stack buffer overflow was detected in the International components for Unicode ICU. While running the genrb binary, the ‘subtag’ structure exceeded its limit at the SRBRoot::addTag function. This issue may lead to memory corruption and the execution of arbitrary local code...

Astra Linux – Vulnerability in u-boot

In Das U-Boot through 2022.07-rc5, an integer signedness error and resulting stack-based buffer overflow occur in the “i2c md” command, which allows for the corruption of the return address pointer of the doi2cmd function...