CVE-2026-62292

In libheif 1.19.0–1.23.1, unc_decoder::fetch_tile_data() computes a large tile offset that, combined with range_start_offset + range_size in get_compressed_image_data_uncompressed(), wraps to zero and bypasses the bounds check. This passes an invalid source pointer and 1 TB length to memcpy, caus...

EUVD-2026-62189

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile. In...

GHSA-P23G-MVHJ-JH3J GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...

gstreamer1-plugins-bad-free security update

1.26.7-2.7 - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 1.26.7-2.5 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats CVE-2026-59691 Resolves: RHEL-193550 1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves...

CVE-2026-74453

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

UBUNTU-CVE-2026-74453

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

CVE-2026-74453

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

CVE-2026-74453

CVE-2026-74453 (Linux kernel, drm/vc4) : The issue arises in the VC4 tile binning path where the Tile State Data Array (TSDA) for a job’s tile set is left in the binner’s slot between submissions. A 16 MB binner buffer is split into 512 KB slots; TSDA is at the start of each slot and is used by h...

CVE-2026-74453 drm/vc4: Zero the tile state data array before each BIN job

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

EUVD-2026-59646

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

CVE-2026-74453 drm/vc4: Zero the tile state data array before each BIN job

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

Linux Distros Unpatched Vulnerability : CVE-2026-74453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submissi...

CVE-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-56865

Technical details about CVE-2026-56865 are not publicly available in the provided documents. Monitor for updates.

GO-2026-6179 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue: CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394. Patch Instructions: To install this SUSE update use the SUSE recommended...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, the progressivedecompresstileupgrade function detected mismatches using progressiverfxquantcmpequal, but only emitted a WLogWARN message; execution continued. The wrapped value 247 was used as a shift...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Media: Verisilicon: AV1 – Fix for the tile info buffer size. Each tile consists of: rowsb, colsb, startpos, and endpos 4 bytes each. Therefore, the total memory required is AV1MAXTILES 16 bytes. Use the correct define to allocate...