Grigory Chudov’s buffer error vulnerability

Grigory Chudov’s libtta versions 2.3 and earlier have a buffer error vulnerability. This vulnerability arises from the lack of header checks that reject zero audio channels. An attacker can create a specially crafted .tta file that declares zero audio channels, causing the application to access...

AbiWord wv buffer error vulnerability

AbiWord versions 1.2.9 and earlier have a buffer error vulnerability. This vulnerability stems from the lack of verification of the FKP run count in functions wvGetPAPXFKP and wvGetCHPXFKP. Attackers can read content that exceeds the 512-byte stack buffer by providing a specially crafted.doc file...

Johannes Kuhlmann cgltf buffer error vulnerability

Johannes Kuhlmann’s cgltf versions prior to 1.15 have a buffer error vulnerability. This vulnerability stems from the cgltfaccessorunpackfloats function, which does not check the sparse accessor indices. This can lead to out-of-buffer writes. Attackers can write large sparse indices into the outp...

Netcore NR256CN buffer error vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have a buffer error vulnerability. This vulnerability stems from the Boa web server’s userok function, which does not validate the length of the Basic-auth username. The username is copied into a 64-byte stack buffer using strcpy, allowing...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability arises from checkDataSetAccess, which reverses the source and destination parameters ofStringUtilscopyStringToBuffer when constructing the MMSASSOCIATIONSPECIFIC dataset reference. As a...

MariaDB Server buffer error vulnerability

MariaDB Server versions from 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.1 to 11.4.13, 11.8.1 to 11.8.9, 12.3.1 to 12.3.3, and 13.0.1 to 13.0.2 have a buffer error vulnerability. This vulnerability arises from STArea, which processes invalid WKBs for MultiPolygon. The polygon parser does not...

MariaDB Server buffer error vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a buffer error vulnerability. This vulnerability arises from STAsText, when converting deeply nested GeometryCollections, where recursive...

Latchset LUKSMeta buffer error vulnerability

The LATCHSET LUKSMeta exists buffer error vulnerability stems from luksmeta’s improper boundary verification of metadata slots. Attackers can redirect erasure or loading operations outside the intended metadata area by providing or modifying disk heads. This allows them to overwrite or clear...

Lenovo Energy Management Driver buffer error vulnerability

Versions of the Lenovo Energy Management Driver prior to 15.11.30.14 contain a buffer error vulnerability. This vulnerability stems from out-of-bounds writes, which may cause blue-screen errors for locally authenticated users...

GStreamer gst-plugins-good buffer error vulnerability

GStreamer’s gst-plugins-good version prior to 1.28.2 has a buffer error vulnerability. This vulnerability stems from the qtdemuxparsechnl function in the isomp4 plugin during MP4 file parsing, which may cause out-of-bounds read access to global arrays, potentially leading to information leakage...

RIOT OS Buffer Error Vulnerability

RIOT OS versions before 2026.04 have a buffer error vulnerability. This vulnerability stems from the atwinc15x0stasetcurrentssid function in the ATWINC15x0 driver, which uses strcpy to copy an SSID without checking the target size. When MODULEATWINC15X0DYNAMICCONNECT is enabled, nearby attackers...

RIOT OS Buffer Error Vulnerability

RIOT OS versions before 2026.07 have security vulnerabilities. These vulnerabilities stem from the parsereply function in sys/net/applicationlayer/dhcpv6/client.c. This function fails to perform a minimum length validation before passing the IAPD and IANA option bodies to the sub-option parser...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability stems from the parseUserInformation function, which checks if len is zero before verifying the returned negative bufPos. As a result, errors are ignored, and the buffer-1 is read, leading to...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 6, 7, and 8 have a buffer error vulnerability. This vulnerability stems from multiple migration data processing programs in spice-server using offsets provided by clients from the SPICEMSGCMIGRATEDATA message, without any boundary validation. This can allow...

HPE NonStop SQL/MX EXE buffer error vulnerability

The HPE NonStop SQL/MX EXE T1051L40 and earlier versions contain a buffer error vulnerability. This vulnerability arises because corrupted files may lead to out-of-bounds reads, resulting in information leakage, process termination, CPU shutdown, or data corruption...

HPE NonStop TNS/X Native Inspect buffer error vulnerability

The HPE NonStop TNS/X Native Inspect T0903L02^AAL and earlier versions contain a buffer error vulnerability caused by address corruption, which may lead to an execution flow redirection...

libsidplayfp buffer error vulnerability

LibSidPlayFP versions 3.1.1 and earlier have a buffer error vulnerability. This vulnerability stems from the lack of checking the data offset of the PSID/RSID files. An attacker can set the header data offset to exceed the file size, causing length calculations to wrap around. The resolveAddrs...

NIFTI-Imaging NIFTI C Libraries Buffer Error Vulnerability

The NIFTI-Imaging NIFTI C libraries versions 3.0.1 and earlier have a buffer error vulnerability. This vulnerability stems from the fact that the function nifticonvertn2hdr2nim does not perform range checks on the NIfTI-2 dim0 value. This allows stack-based out-of-bounds reads and writes. Attacke...

SICK AG: Sick_Safetyscanners_Base CPP Driver buffer error vulnerability

SICK AG: SickSafetyscannersBase CPP Driver 1.0.4 and earlier versions have a buffer error vulnerability. This vulnerability stems from insufficient validation of the data packet length, which may lead to out-of-bounds memory access, causing application crashes and denial-of-service attacks...

Randall Hand Yerase’s TNEF Stream Reader buffer error vulnerability

Randall Hand Yerase’s TNEF Stream Reader 2.1.2 and earlier versions have a buffer error vulnerability. This vulnerability stems from the improper handling of compressed RTF attributes by the MAPIPrint function. After decompression, the RTF files lack the NUL terminator, leading to out-of-bounds...