CVE-2026-12548

CVE-2026-12548: A heap out-of-bounds read in libsoup during multipart HTTP parsing arises from an integer type mismatch in soup_headers_parse(), which truncates the length parameter and triggers a heap buffer over-read. This could crash applications using libsoup or potentially disclose heap memo...

CVE-2026-64064

A flaw was found in the Linux kernel's netfs component. When a streaming write operation is performed, a memory page folio can remain marked as 'dirty' even after the associated data is removed by a file truncation. If this dirty page is subsequently accessed through a memory-mapped file mmap, th...

CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

EUVD-2026-45601

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-64028

In the Linux kernel tracing subsystem, CVE-2026-64028 affects hist_field_name() in the fully-qualified VAR_REF/EXPR path: when snprintf() truncation returns NULL, callers mistakenly dereference NULL in strcat(expr, hist_field_name(field, 0)) and in a sort-key strcmp, potentially leading to NULL d...

CVE-2026-64028 tracing: Avoid NULL return from hist_field_name() on truncation

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-64028 tracing: Avoid NULL return from hist_field_name() on truncation

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

EUVD-2026-45520

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

PT-2026-61345

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist field name on truncation hist field name returns "" everywhere except the fully-qualified VAR REF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

PT-2026-61103

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO NO NAME decode error cleanup nfsd4 decode secinfo no name currently initializes sin exp after decoding sin style. If the XDR stream is truncated, the decoder returns nfserr bad xdr before sin exp is initialized...

CVE-2026-53994 ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation

ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...

EUVD-2026-44709

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via OTRUNC, and can happen before full input validation completes “truncation-before-validation...

CVE-2026-61371

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via OTRUNC, and can happen before full input validation completes “truncation-before-validation...

CVE-2026-61371

Microsoft AVML before 0.17.0 is affected. On Unix, it could follow a symlink when opening a destination output path, allowing truncation/overwrite of the symlink target at open-time via O_TRUNC and potentially before full input validation. This is described as a truncation-before-validation issue...

CVE-2026-61371

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via OTRUNC, and can happen before full input validation completes “truncation-before-validation...

JLSEC-2026-729 wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM...

wolfSSL's wcPKCS7DecodeAuthEnvelopedData does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸...

JLSEC-2026-753 A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting...

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This...

CVE-2026-55142

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

CVE-2026-50357

Numeric truncation error in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...