18 matches found
CVE-2026-90554
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
CVE-2026-90554
A flaw was found in vLLM. This vulnerability allows a remote attacker to cause a denial of service by providing a specially crafted, highly compressed video as multimodal input when the NanoNemotronVL model is configured to use audio from video. The lack of proper size or duration limits during...
EUVD-2026-76872
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
CVE-2026-90554 vLLM before 0.28.0 Denial of Service via audio extraction
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
CVE-2026-66036
FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...
OSV-2026-903 UNKNOWN in avi_parse_input_file
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=522061221 Crash type: UNKNOWN Crash state: aviparseinputfile AVIopeninputfile avidmxprocess...
Linux Distros Unpatched Vulnerability : CVE-2021-21837
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A...
Linux Distros Unpatched Vulnerability : CVE-2021-21842
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A speciall...
OESA-2025-1771 ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A heap-use-after-free i...
UNISOC Chipsets Security Vulnerability
UNISOC Chipsets is a chipset from China's Unisolar Corporation UNISOC. A security vulnerability exists in UNISOC Chipsets that stems from improper validation of video decoder input, which may result in out-of-bounds reads. It could result in a local denial of service without additional execute...
CVE-2021-33499
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation issue 2 of 2...
CVE-2021-33499
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation issue 2 of 2...
CVE-2021-21856
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflo...
UBUNTU-CVE-2021-21839
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that...
CVE-2021-21858
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflo...
Input Validation Error Vulnerability in Multiple Qualcomm Products (CNVD-2020-41777)
Qualcomm MDM9206 and others are products of Qualcomm Incorporated.The MDM9206 is a central processing unit CPU product.The MDM9607 is a central processing unit CPU product.The SDX20 is a modem.The MDM9206 is a central processing unit CPU product.The MDM9607 is a central processing unit CPU...
Rosewill RSVA11001 - Remote Command Injection
No description provided by source. I have been hacking on a Rosewill RSVA11001 for a while now, something to suck up my free time. I had pulled apart the firmware previously but did not succeed in finding a way to get a shell on the device. The box is Hi3515 based, I found an exploit for another...