EUVD-2026-63653

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations i...

CVE-2026-70651

In libvips versions before 8.18.3, the ImageMagick fallback path in magick6load.c and magick7load.c multiplies per-page Ysize by n_frames without bounds checking, causing a heap buffer over-read and crash when loading a crafted multi-page TIFF. CVSS 6.9 (medium), local attack vector. Fixed in 8.1...

EUVD-2026-63652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...

CVE-2026-70652

libvips versions before 8.18.3 mis-size an output buffer in vips_foreign_save_uhdr_set_raw_hdr (libvips/foreign/uhdrsave.c) when a pipeline enlarges a JPEG before encoding a gain map, causing a heap buffer over-read that can leak adjacent data or crash the process. Upgrade to 8.18.3 to remediate....

CVE-2026-70652 libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...

CVE-2026-70652 libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...

CVE-2026-74324

A flaw was found in the mt7925 Wi-Fi driver of the Linux kernel. An attacker could exploit this vulnerability by providing a specially crafted firmware response during a test mode query. This improper validation of the response length can lead to a buffer over-read, potentially disclosing sensiti...

CVE-2026-76885

A flaw was found in Wireshark. This vulnerability, a buffer over-read, occurs when the Tektronix K12xx file parser processes a specially crafted file. A remote attacker could exploit this by convincing a user to open a malicious Tektronix K12xx file, leading to a crash of the Wireshark applicatio...

EUVD-2026-63481

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe...

CVE-2026-76884

A flaw was found in Wireshark. A remote attacker could exploit a buffer over-read vulnerability in the ERF Extensible Record Format file parser. This could lead to a denial of service, making the application unavailable to legitimate users. Mitigation Avoid opening ERF Extensible Record Format...

PT-2026-79141

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations i...

CVE-2026-76885

A buffer over-read in Wireshark's Tektronix K12xx file parser (CVE-2026-76885) affects versions 4.6.0–4.6.7 and 4.4.0–4.4.18, allowing denial of service when a crafted capture file is opened. The CVSS score is 3.1 (LOW) with high attack complexity and required user interaction. No exploitation in...

CVE-2026-76885 Buffer Over-read in Wireshark

Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76884 Buffer Over-read in Wireshark

ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76884

Wireshark's ERF file parser crashes on crafted ERF files in versions 4.4.0–4.4.18 and 4.6.0–4.6.7, enabling remote denial of service (CVSS 3.1 LOW). No exploitation details are provided; upgrading to a patched version resolves the issue.

postfix: buffer over-read via malformed enhanced status code

A flaw was found in Postfix. This issue occurs when processing enhanced status codes, specifically an enhanced status code that lacks text following the third number. Depending on the configuration of the server, this allows a remote attacker to cause a buffer over-read of only 1 byte, leading to...

Important: Red Hat Security Advisory: postfix security update

An update for postfix is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

EUVD-2026-62673

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by th...

CVE-2026-55648

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixelformat in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO...

CVE-2026-74532

A flaw was found in the Bluetooth btintel driver of the Linux kernel. The btinteldiagnostics function fails to validate the length of a diagnostics Vendor Specific Event VSE before accessing its data. This oversight allows an attacker to potentially read data beyond the intended memory boundary,...