CVE-2026-113782

The ESP-IDF (Espressif Internet of Things Development Framework) contains a stack-based buffer overflow (CWE-121) in the OpenThread Border Router Neighbor Discovery packet handler. Specifically, the handler trusts an attacker-controlled ICMPv6 option length while copying data into a fixed stack b...

CVE-2026-121958

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTableGetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can...

CVE-2026-121952

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

CVE-2026-121954

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

EUVD-2026-116962

FreeRDP before 3.32.2 contains a heap buffer overflow in transportdefaultreadpdu when handling partial Early User Authorization reads during PROTOCOLHYBRIDEX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB...

CVE-2026-121958

FreeRDP versions through 3.32.1 contain a heap out-of-bounds write in the RDPGFX client . The vulnerability exists because the delete_surface callback truncates surface hash keys to 16 bits, causing an inconsistency in the surface table. This leads HashTable_GetKeys to write past the allocated ke...

CVE-2026-121958 FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTableGetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can...

EUVD-2026-116958

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTableGetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can...

CVE-2026-121954

FreeRDP versions before 3.32.2 are vulnerable to a heap out-of-bounds write in the planar codec . The issue occurs because freerdp_bitmap_planar_context_reset commits new dimensions before confirming successful buffer reallocation; if ResetGraphics fails, the error is only logged. A malicious RDP...

CVE-2026-121954 FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

EUVD-2026-116954

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

CVE-2026-121952 FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

EUVD-2026-116952

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

CVE-2026-121952

FreeRDP versions before 3.32.2 are vulnerable to an out-of-bounds write within the proxy component. The root cause is that the function rdp_read_bitmap_cache_v2_capability_set only rejects numCellCaches values greater than 5, but the application subsequently accesses the bitmap cache v2 cell arra...

objdump-Out-Of-Bounds-write

GNU Binutils objdump — OOB Write → FSOP → Arbitrary Code Execution Target: GNU Binutils all versions through HEAD — objdump Environment: Debian 13 Trixie, glibc 2.41, x8664 Impact: Arbitrary code execution Vector: Crafted ELF file processed by objdump -g ASLR: Bypassed deterministic mmap delta...

tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data

A flaw was found in Tesseract. The FullyConnected::DeSerialize function does not properly validate the dimensions of deserialized layers against the weight-matrix dimensions. This vulnerability allows a remote attacker to provide a specially crafted .traineddata file, leading to a heap...

tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A local attacker could provide a specially crafted .traineddata file, which, when processed, could lead to a heap out-of-bounds write. This vulnerability occurs due to unvalidated counts used as loop bounds...

tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. The UNICHARSET::loadviafgets function incorrectly trusts a declared character count, which can lead to an out-of-bounds write in memory. A remote attacker could exploit this vulnerability by providing a...

Important: Red Hat Security Advisory: tesseract security update

An update for tesseract is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit a heap out-of-bounds write vulnerability in the LSTM::Forward function by providing a specially crafted input. This could lead to heap corruption, application crashes, or...