CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

EUVD-2026-109113

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

Versions of ConnMan through 2.0 are vulnerable to a stack-based buffer overflow in the get_domains function located in gdhcp/client.c. The flaw occurs because the software copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) into a 1026-byte stack buffer regardless of the actual option...

CLSA-2026-1792770638 Fix CVE(s): CVE-2026-15176

SECURITY UPDATE: heap buffer overflow in ngxhttpmapuritopath when $requestfilename is evaluated after a rewrite inside an "alias" location - debian/patches/CVE-2026-15176.patch: reject the URI to path mapping for an "alias" location while r-urichanged is set, and clear r-validlocation in...

CVE-2026-97631

A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service DoS...

SUSE-SU-2026:24415-1 Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.37.1 fixes various security issues: The following security issues were fixed: - CVE-2026-63887: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf bsc1272386. - CVE-2026-64054: net: shaper: reject duplicate leaves in...

Security Bulletin: IBM MQ Appliance is affected by an off-by-one buffer overflow vulnerability (CVE-2026-12727)

Summary IBM MQ Appliance has addressed an off-by-one buffer overflow vulnerability that could allow an authenticated attacker to cause potential process instability when processing specially crafted object names. Vulnerability Details CVEID:CVE-2026-12727 DESCRIPTION: IBM MQ could allow an...

CLSA-2026-1792768177 freerdp: Fix of CVE-2026-55193

CVE-2026-55193: fix heap buffer overflow in the TS Gateway RPC client; ensure remaining capacity in rpcchannelread and reject bindack fragment sizes above 0x0FF8...

Security Bulletin: IBM MQ Appliance is affected by a heap-based buffer overflow vulnerability (CVE-2026-10574)

Summary IBM MQ Appliance has addressed a heap-based buffer overflow vulnerability that could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code when processing MQPUT or MQPUT1 operations with malformed message handle properties. Vulnerability Detail...

CVE-2026-53921

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

CVE-2026-53921

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

EUVD-2026-108966

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

CVE-2026-53921

A critical stack-based buffer overflow exists in the odhcpd daemon of OpenWrt , affecting versions prior to 24.10.8 and 25.12.5 . The vulnerability is triggered during the serialization of DHCPv6 Reply packets in the build_ia() and dhcpv6_ia_handle_IAs() functions. When processing a specially cra...

CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99021

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

AZL-110680 CVE-2026-98912 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event sndseqossread checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It...

DEBIAN-CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...