ANT-2026-19SGCVZZ · Alembic · Heap Buffer Overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-19SGCVZZ: Heap buffer overflow in Ogawa...

CVE-2026-49757: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...

Malicious code in web3-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8d6102ae402b2583a01da47e71f41cccba99fb7826dcf360004d8924557e1760 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Malicious code in alembic-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9b764ee0ccd6a2c6c2db1b7722f083ee9f643cb99d03821d5e6571f68db253 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

MAL-2026-3700 Malicious code in alembic-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9b764ee0ccd6a2c6c2db1b7722f083ee9f643cb99d03821d5e6571f68db253 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Apple macOS libusd_ms Alembic File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must receive a malicious file that is written to the local filesystem. The specific flaw exists within the...

python-alembic bug fix and enhancement update

An update is available for python-alembic. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Lin...

alembic:alembic_dump_info_fuzzer: Crash in Alembic::AbcCoreOgawa::v12::ReadTimeSamplesAndMax

Detailed Report: https://oss-fuzz.com/testcase?key=6497274247380992 Project: alembic Fuzzing Engine: centipede Fuzz Target: alembicdumpinfofuzzer Job Type: centipedeasanalembic Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x000001eb3000 Crash State:...

alembic:alembic_dump_info_fuzzer: Heap-buffer-overflow in Alembic::Ogawa::v12::MemoryMappedIStreamReader::read

Project: https://github.com/alembic/alembic.git Detailed Report: https://oss-fuzz.com/testcase?key=5783397698633728 Project: alembic Fuzzing Engine: libFuzzer Fuzz Target: alembicdumpinfofuzzer Job Type: libfuzzerasanalembic Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 9 Crash Addres...

alembic:alembic_dump_info_fuzzer: Segv on unknown address in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/alembic/alembic.git Detailed Report: https://oss-fuzz.com/testcase?key=5723831061446656 Project: alembic Fuzzing Engine: libFuzzer Fuzz Target: alembicdumpinfofuzzer Job Type: libfuzzerasanalembic Platform Id: linux Crash Type: Segv on unknown address Crash Address:...

alembic:alembic_dump_info_fuzzer: Segv on unknown address in std::__1::__tree_node_base<void*>* std::__1::__tree_min<std::__1::__tree_node_ba

Project: https://github.com/alembic/alembic.git Detailed Report: https://oss-fuzz.com/testcase?key=5636402992381952 Project: alembic Fuzzing Engine: afl Fuzz Target: alembicdumpinfofuzzer Job Type: aflasanalembic Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

alembic:alembic_dump_info_fuzzer: Heap-buffer-overflow in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

Project: https://github.com/alembic/alembic.git Detailed Report: https://oss-fuzz.com/testcase?key=4609694851923968 Project: alembic Fuzzing Engine: afl Fuzz Target: alembicdumpinfofuzzer Job Type: aflasanalembic Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...