Important: Red Hat Security Advisory: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libreoffice: stack buffer overflow in CFF font hint handling

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

libreoffice: stack buffer overflow in CFF to Type 1 font conversion

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

ALSA-2026:88164 Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fixes: libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion CVE-2026-63276...

PT-2026-121562

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write 16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions ...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792562667)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792562667 advisory. - GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

RHEL 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (RHSA-2026:88164)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88164 advisory. SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fixes:...

Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fixes: libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion CVE-2026-63276...

Bytecode Alliance wasmtime input validation error vulnerability

In versions prior to Bytecode Alliance Wasmtime 48.0.4, there is an input validation error vulnerability. This vulnerability stems from the failure to validate the type of results returned by asynchronous callbacks, leading to a stack buffer overflow. A malicious visitor can write approximately 1...

CLSA-2026-1792562667 gstreamer1-plugins-bad-free: Fix of 2 CVEs

CVE-2026-3082: jpegparser: fix heap buffer overflow by checking the Huffman table length against its storage before copying it - CVE-2026-59692: dtls: fix stack buffer overflow by allocating the buffer for the peer certificate subject DN to its printed length...

CLSA-2026-1792536927 libevent: Fix of 5 CVEs

CVE-2026-63383: fix out-of-bounds read in decodetaginternal - CVE-2026-63384: reject payload lengths above INTMAX in evtagunmarshalheader - CVE-2026-63387: fix off-by-one stack buffer overflow in dnsnametolabels - CVE-2026-63385: reject HTTP header values containing CR or LF - CVE-2026-63382:...

CLSA-2026-1792562041 gstreamer1-plugins-bad-free: Fix of 2 CVEs

CVE-2026-3082: jpegparser: fix heap buffer overflow by checking the Huffman table length against its storage before copying it - CVE-2026-59692: dtls: fix stack buffer overflow by allocating the buffer for the peer certificate subject DN to its printed length...

RHEL 8 : libxml2 (RHSA-2026:79120)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79120 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

RHEL 9 : libreoffice (RHSA-2026:82013)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82013 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processo...

TOTOLINK EX200 buffer error vulnerability

The TOTOLINK EX200 version 5.2.3c.7200 contains a buffer error vulnerability. This vulnerability arises from the stack buffer overflow caused by the setWiFiAclAddConfig function in the file /cgi-bin/cstecgi.cgi when processing the macAddress parameter. Attackers can exploit this vulnerability...

CLSA-2026-1789661605 python: Fix of 3 CVEs

CVE-2026-9669: fix a stack buffer overflow in the bz2 module when a BZ2Decompressor object is reused after a decompression error; the decompressor now becomes unusable once libbz2 reports an error, instead of resuming from an invalid internal state...

CLSA-2026-1792537208 libevent: Fix of 5 CVEs

CVE-2026-63383: fix out-of-bounds read in decodetaginternal - CVE-2026-63384: reject payload lengths above INTMAX in evtagunmarshalheader - CVE-2026-63387: fix off-by-one stack buffer overflow in dnsnametolabels - CVE-2026-63385: reject HTTP header values containing CR or LF - CVE-2026-63382:...

CLSA-2026-1792536579 libevent: Fix of 5 CVEs

CVE-2026-63383: fix out-of-bounds read in decodetaginternal - CVE-2026-63384: reject payload lengths above INTMAX in evtagunmarshalheader - CVE-2026-63387: fix off-by-one stack buffer overflow in dnsnametolabels - CVE-2026-63385: reject HTTP header values containing CR or LF - CVE-2026-63382:...

CVE-2026-103672

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...

EUVD-2026-105321

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...