EUVD-2026-115640

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-120752

A flaw was found in PyMuPDF. An attacker who controls input passed to the free text annotation feature can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS by crashing the application. This issue is caused by copying caller-supplied callout points into a...

CVE-2026-29508

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-29508

A flaw was found in minidlna. This vulnerability allows a remote attacker to achieve arbitrary code execution or cause a Denial of Service DoS by placing a specially crafted DFF audio file into a directory monitored by the service. When processing the file, the application fails to validate an...

EUVD-2026-115624

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-120067

A flaw was found in postgresql-odbc. When processing updatable database queries, the driver copies internal row metadata into a fixed-size memory buffer without verifying the data length sent by the server. A malicious database server or an untrusted user capable of creating custom database views...

CVE-2026-120061

A flaw was found in postgresql-odbc. When processing Open Database Connectivity ODBC escape sequences in SQL statements, the parser fails to properly validate buffer boundaries. An attacker capable of submitting untrusted SQL text to an application using the driver can trigger a stack-based buffe...

CVE-2026-106808

OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...

SUSE CVE-2026-120252

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decodejpegsof3. Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack...

CVE-2026-106803

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsregistrarpcscf module. When processing a crafted application/reginfo+xml NOTIFY message, processcontact copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validatin...

CVE-2026-106804

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsqosnpn module. The wrxaarregister function copies the attacker-controlled host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger...

CVE-2026-120433

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table (CVE-2026-104332)

Summary IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table Vulnerability Details ID: CVE-2026-113698 DESCRIPTION: IBM Db2 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query...

EUVD-2026-115193

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements

A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the xmlSnprintfElements function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited...

CVE-2026-120252

A flaw was found in imagecodecs. A stack-based buffer overflow exists in the lossless JPEG parser within the decodejpegsof3 function due to improper validation of Huffman table symbol counts. By enticing a user or application to process a specially crafted lossless JPEG image file, an attacker...

gimp: GIMP: Remote code execution via TIF file parsing vulnerability

A flaw was found in GIMP. This vulnerability, a stack-based buffer overflow in the TIF file parsing component, allows a remote attacker to execute arbitrary code. User interaction is required, as the target must open a specially crafted malicious TIF file. The issue stems from insufficient...

CVE-2026-57188

A flaw was found in Asterisk. This vulnerability allows an authenticated remote attacker to cause a Denial of Service DoS by sending specially crafted network packets to the resxmpp module. When processing Extensible Messaging and Presence Protocol XMPP namespace prefixes from a local or federate...

CVE-2026-120336

A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN10003EA0 in the library DevDll925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could b...