CVE-2026-107383

The MariaDB Connector/Node.js library is vulnerable to information disclosure in versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 . The issue resides in the GeoJSON Polygon and MultiPolygon binary encoders , which size a Buffer.allocUnsafe() allocation based on a ring's numeric length before veri...

CVE-2026-107676

FFmpeg versions through 9.0.2 are vulnerable to an uninitialized memory disclosure within the av_dynamic_hdr_plus_to_t35() function. When the tone_mapping_flag is set to 0, the function fails to initialize up to three payload bytes. An attacker can exploit this by providing crafted Matroska T.35 ...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

thunderbird: Uninitialized memory in MIME parsing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

thunderbird: Uninitialized memory in MIME parsing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

thunderbird: Uninitialized memory in MIME parsing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

CVE-2026-104074 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

CVE-2026-104074 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

Oracle Linux 8 : gd (ELSA-2026-75680)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-75680 advisory. 2.2.5-8 - Fix CVE-2026-9672: incorrect array index and uninitialized memory in GIF LZW decoder Resolves: RHEL-259584 Tenable has extracted the preceding...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg – Zero initialize memory allocated via sockkmalloc Several crypto user API contexts and requests that were allocated using sockkmalloc remained uninitialized. This meant that callers had to explicitly set the fields...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: UDF: Fixed uninitialized array access for some pathnames For filenames that start with . and are between 2 and 5 characters long, the UDF charset conversion code would read uninitialized memory from the output buffer. The only...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first gain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw resides within...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: mctp: Do not access ifaindex when it is missing In mctpdumpaddrinfo, ifaindex can be used to filter interfaces, but only when the struct ifaddrmsg is provided. Otherwise, it will compare to uninitialized memory—a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: efivarfs: fixed error propagation in efivarentryget The efivarentryget function always returns success, even if the underlying efivarentryget function fails, thereby masking errors. This may result in uninitialized heap memory...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: The issue of information leakage in f2fsmoveInlinedirents has been fixed. When converting an inline directory to a regular one, f2fs leaks uninitialized memory to the disk because it does not initialize the entire directory...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: comedi: The issue of using uninitialized memory in doinsnioctl and doinsnlistioctl has been fixed. syzbot reports a KMSAN kernel-infosek in doinsnioctl. A kernel buffer is allocated to hold insn-n samples each of which is an...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Allocate memory before using it. KMSAN reports: Multiple uninitialized values were detected: - KMSAN: uninitvalue in ntfsreadhdr 3 - KMSAN: uninitvalue in bcmp 3 Memory is allocated by getname, which is a wrapper for...