Red Hat Enterprise Linux buffer error vulnerability

In Red Hat Enterprise Linux 8 and 9, there is a buffer error vulnerability in gnome-remote-desktop. This vulnerability stems from improper handling of the peek buffer during VNC TLS read operations. A remote attacker can exploit this vulnerability by accessing a enabled VNC TLS listener, resultin...

Open Asset Import Library buffer error vulnerability

The Open Asset Import Library has a buffer error vulnerability, which stems from improper operations in the IOSTreamBuffer::getNextBlock function of the PLY File Handler component. This vulnerability may lead to out-of-bounds reading, and remote attackers can exploit this to carry out attacks...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux Cyrus SASL contains a buffer error vulnerability. This vulnerability stems from the addtochallenge function within the DIGEST-MD5 plugin; it fails to account for any length changes caused by escaping when calculating buffer size. As a result, an out-of-bounds write occurs...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer error vulnerability. This vulnerability arises from the handling of incoming WebSocket Pong frames. SoupWebsocketConnection sends the ::pong signal using a GByteArray pointer. Since this signal is declared to be passed as GBytes, processes that follow the GBytes API may...

GIMP buffer error vulnerability

GIMP has a buffer error vulnerability. This vulnerability arises from the fact that when processing specially crafted GIMPressionist preset files, GIMP plugins incorrectly validate vector indices before writing to fixed-size arrays. This can lead to out-of-bounds writes, memory corruption, and...

QEMU buffer error vulnerability

QEMU has a buffer error vulnerability. This vulnerability stems from VAPIC setup in hw/i386/vapic.c; it fails to verify whether writeable RAM aliases are retained within the option ROM window. As a result, privileged guest users on Q35/KVM machines may overwrite these aliases onto locked SDRAM,...

GIMP buffer error vulnerability

GIMP has a buffer error vulnerability. This vulnerability stems from the Lighting Effects filter in GIMP, which fails to correctly verify the number of light sources when processing specially crafted lighting preset files. This can lead to out-of-bounds writes and memory corruption. Attackers can...

GNOME GVfs buffer error vulnerability

GNOME GVfs has a buffer error vulnerability. This vulnerability stems from the fact that the SFTP backend of GVfs does not verify the length provided by the server against the allocated buffer size. This can lead to out-of-buffer writes and damage to heap memory, potentially causing denial of...

WebKitGTK buffer error vulnerability

WebKitGTK has a buffer error vulnerability stemming from improper memory handling; processing malicious web content may lead to memory corruption...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-74495

CVE-2026-74495 affects the Linux kernel igbvf driver. The issue is a leak in TX DMA error cleanup: when mapping TX buffers, buffers already mapped for a skb must be unmapped. The root cause is an off-by-one error from decrementing the count before the dma_error loop, after the count had been incr...

MediaTek Chipset buffer error vulnerability

MediaTek chipsets contain a buffer error vulnerability stemming from improper input validation in the trustedmem component. This vulnerability may allow malicious actors with System-level privileges to escalate local privileges under user interaction...

Zephyr buffer error vulnerability

Zephyr versions from 3.0.0 to 4.5.0 have a buffer error vulnerability. This vulnerability stems from the user-space verifier zvrfylogfilterset in the subsys/logging/logmgmt.c file. This verifier performs signed comparisons on the int16t srcid parameter. Negative values can bypass the verification...

CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

CVE-2026-6390

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...

CVE-2026-6390

CVE-2026-6390 affects GNU nano. The issue is a format string vulnerability in multi-buffer error handling: when opening multiple files at startup, a filename containing printf format specifiers can be reinterpreted, potentially enabling stack information disclosure, a crash (DoS), or arbitrary me...

CVE-2026-6390: Use of Externally-Controlled Format String

A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...

CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent...

PYSEC-2026-1056 Potential double free of buffer during string decoding

Impact What kind of vulnerability is it? Who is impacted? When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. Patches Has the problem been patche...

EUVD-2026-41787

The MAX32xxx USB device controller driver drivers/usb/udc/udcmax32.c, compatible adimax32usbhs dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udceventxferoutdone called netbufaddbuf, eprequest-actlen immediately after buf =...