CVE-2026-116744 ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...

CVE-2026-116744

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...

CVE-2026-116742 HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzfindexloadhfile in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc0 buffer and an...

CVE-2026-116742

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzfindexloadhfile in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc0 buffer and an...

CVE-2026-116741 Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116741

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116737

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

CVE-2026-116737 libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

CVE-2026-116736 libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpfftablereadvaluesarray because a 7c column definition's valuesarraysize is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory...

CVE-2026-116736

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpfftablereadvaluesarray because a 7c column definition's valuesarraysize is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory...

CVE-2026-116735 libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

CVE-2026-116735

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

CVE-2026-116733 flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

CVE-2026-116734 flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header

flatcc through 0.6.4 contains an integer overflow vulnerability in the checkheader function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the...

CVE-2026-116734

flatcc through 0.6.4 contains an integer overflow vulnerability in the checkheader function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the...

CVE-2026-116733

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

CVE-2026-116732

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex to read past the heap...

CVE-2026-116732 libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex to read past the heap...

CVE-2026-116730 Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-116730

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...