CVE-2008-4654

CVE-2008-4654 Un exploit complètement fonctionnel pour la vulnérabilité de débordement de tampon basé sur la pile CVE-2008-4654 dans VLC Media Player 0.9.4 de VideoLan lors du traitement de fichiers TiVo. Il cible un binaire 32 bits exécuté sur un système Windows 64 bits et utilise un egghunter...

CVE-2020-1020

CVE-2020-1020 Windows Font Driver Type 1 VToHOrigin stack corruption Fonctionne uniquement sur win7 x64...

CVE-2026-17544-PoC

CVE-2026-17544 — PHP bcmath bccomp: запись вне границ буфера разрушение стека CVSS 9.8 критический · CWE-787 · GHSA-x692-q9x7-8c3f Сводка bcstr2num в ext/bcmath/libbcmath/src/str2num.c встроенная libbcmath, PHP 8.4+ содержит ошибку off-by-N, приводящую к записи вне границ. Когда переданный...

OPENSUSE-SU-2026:21593-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

BIT-POSTGRESQL-2026-14679 PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

Treck20-Related

Treck20-관련 CVE-2020-11896 Treck TCP/IP 스택 및 디바이스 자산 조사에 대한 PoC 프로토콜 스택 점검 많은 제조업체들이 Treck 프로토콜 스택을 채택하고 있으며, 일부 제조업체는 하드웨어 IP 코어를 통해 Treck 프로토콜 스택을 참조합니다. 디바이스 지문만으로 취약점을 식별하는 것만으로는 충분하지 않습니다. 대상 디바이스가 Treck 프로토콜 스택인지 탐지하는 방법이 자산 조사의 핵심이 됩니다. 다음은 Treck 프로토콜 스택 지문 탐지 방법입니다: Treck 프로토콜 스택은 유형...

CVE-2026-58084

In FreeBSD 15.0 and 15.1, realtimer_gettime() returns an error for CLOCK_TAI timers when no TAI offset is configured, but the return value is unchecked and the uninitialized buffer is copied to userspace via timer_settime(2). An unprivileged local user can exploit this to read kernel stack memory...

CVE-2026-58082

The ISO-2022 encoding module in FreeBSD's iconv(3) allocates a 6-byte stack buffer (MB_LEN_MAX) but some variants require up to 10 bytes per character, causing up to a 4-byte stack overflow. Affects all supported FreeBSD versions; patched in stable/14 and stable/15 branches on 2026-06-30. No work...

EUVD-2026-62349

The ISO-2022 encoding module used a stack buffer sized to MBLENMAX 6 bytes for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv3 to...

CVE-2026-49425

The FreeBSD compat32 kevent() handler translates a 64-bit struct into an uninitialized stack-declared 32-bit struct, allowing unprivileged users to observe small amounts of kernel stack data. Affects FreeBSD 14.3, 14.4, and 15.0. No workaround exists; upgrade to patched releases (14.3-RELEASE-p16...

EUVD-2026-62346

The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...

CVE-2026-49424

The Linuxulator's waitid() syscall translates a FreeBSD siginfo_t into a stack-declared Linux siginfo_t without zeroing it first, leaking 104 bytes of uninitialized kernel stack data to unprivileged users. Affected: FreeBSD 14.3, 14.4, and 15.0. No workaround exists; systems not using the Linux b...

CVE-2026-49422

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49420

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

EUVD-2026-62244

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

EUVD-2026-62242

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

CVE-2026-49420 Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

CVE-2026-49420

The RTSP handler in FreeBSD's libalias library writes rewritten packets into a fixed-length stack buffer without bounds checks, enabling a stack buffer overflow triggered by crafted RTSP traffic on NAT ports 554/7070, leading to RCE in the kernel (ipfw(4) NAT) or root-owned natd(8) process. Worka...

CVE-2026-72396

A flaw was found in the Linux kernel's hwmon subsystem, specifically in the adm1275 driver. This vulnerability allows a local attacker or a specially crafted device to trigger an out-of-bounds read during device name comparison. By providing a device name shorter than expected, uninitialized stac...

CVE-2026-76008

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...