DEBIAN-CVE-2026-109242

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...

CVE-2026-109242

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...

CVE-2026-109259

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process...

EUVD-2026-97713

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory...

CVE-2026-109269 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory...

CVE-2026-109269

The ImageMagick software versions prior to 6.9.13-57 and 7.x before 7.1.2-32 are vulnerable to an information disclosure vulnerability within the JPEG decoder . The root cause is an out-of-bounds read that occurs when the decoder processes crafted input, potentially exposing uninitialized memory ...

CVE-2026-109269 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory...

CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process...

CVE-2026-109259

The ImageMagick library is vulnerable to an information disclosure flaw in its TGA image decoder . Specifically, versions prior to 6.9.13-57 and 7.x before 7.1.2-32 contain an uninitialized memory read that can expose internal memory contents. An attacker can trigger this by providing a crafted T...

CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process...

EUVD-2026-97703

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process...

thunderbird: Uninitialized memory in MIME parsing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

Important: firefox

Issue Overview: Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. CVE-2026-100756 Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR...

CVE-2026-109259: Exposure of Sensitive Information to an Unauthorized Actor

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process...

CVE-2026-109269: Out-of-bounds Read

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory...

CVE-2026-109242: Use of Uninitialized Resource

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile-current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-066)

The version of firefox installed on the remote host is prior to 140.17.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-066 advisory. Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR...

gd security update

2.3.2-3.1 - Fix buffer overflow and use of uninitialized memory in GIF decoding CVE-2026-9672 Related: RHEL-259613...

Linux Distros Unpatched Vulnerability : CVE-2026-98377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vlan: require the MAC header to be present in vlaninsertinnertag vlaninsertinnertag only guarantees head room via skbcowhead, never that maclen bytes of MAC...

Linux Distros Unpatched Vulnerability : CVE-2026-107676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when...