CVE-2026-116741

The Speex (libspeex) library, versions through 1.2.1 , is vulnerable to an out-of-bounds write in the speex_bits_read_whole_bytes() function located in libspeex/bits.c. The root cause is the incorrect handling of length truncation for non-owned SpeexBits buffers . An attacker can exploit this by ...

CVE-2026-116741 Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116739 VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116739

VMime versions through 0.9.2 are vulnerable to an information disclosure flaw within the uuEncoder::decode function. The root cause is the writing of uninitialized stack memory into decoded output when processing over-long lines. An attacker can exploit this by sending a crafted uuencode or x-uue...

CVE-2026-116739

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116739 VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116738

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

CVE-2026-116738

VMime versions up to and including 0.9.2 are vulnerable to a stack-based buffer overflow due to an integer underflow in the uuEncoder::decode function. A remote attacker can exploit this by sending an email containing crafted uuencoded MIME parts; specifically, a uuencoded line with a length char...

CVE-2026-116738 VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

CVE-2026-116738 VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

CVE-2026-116738 VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

CVE-2026-116723 FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte colormap array,...

CVE-2026-116723

The FLTK library (versions through 1.4.5 ) contains a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. The root cause is an insufficient check on the colors_used field in BMP or ICO files; providing a value greater than 256 can overflow the 768-byte colormap ar...

CVE-2026-116723 FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte colormap array,...

CVE-2026-116508

A stack-based buffer overflow exists in the TOTOLINK A950RG (version 4.1.2cu.5268_B20221104) within the Device-Information CGI component. Specifically, the function sub_402340 in the infostat.cgi file is vulnerable when an attacker manipulates the CONTENT_LENGTH argument. This flaw allows for rem...

CVE-2026-116508 TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected by this issue is the function sub402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENTLENGTH results in stack-based buffer overflow. Remote...

CVE-2026-84604

A stack buffer overflow was addressed through improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted audit file may corrupt process memory...

CVE-2026-112414

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted message may lead to a denial-of-service...

CVE-2026-116586 Go JOSE: Panics in JSON parsing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...