329736 matches found
CVE-2026-114383
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The...
CVE-2026-114382
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely...
CVE-2026-96778
A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS. This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color...
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
============================================================================ Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in tiffWriteProc Commit: a707c6b21c313880d0771e54965d142dd42358b6...
GHSA-332P-7HRC-92WF Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
============================================================================ Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in tiffWriteProc Commit: a707c6b21c313880d0771e54965d142dd42358b6...
EUVD-2026-104603
Pillow: Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO...
PYSEC-2026-4343
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
PYSEC-2026-4343
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
CVE-2026-96644
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
UBUNTU-CVE-2026-96641
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/imaging.c checks positive glyph advances against INTMAX but does not check negative advances against INTMIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in...
UBUNTU-CVE-2026-96642
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...
CVE-2026-96641
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/imaging.c checks positive glyph advances against INTMAX but does not check negative advances against INTMIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in...
CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...
CVE-2026-96778
The Pillow Python imaging library (versions 9.4.0 through 13.0.0 ) contains a heap buffer overflow in src/libImaging/JpegEncode.c. The ImagingJpegEncode() function can call jpeg_write_marker() for a JPEG COM comment when an ICC profile exactly fills the 65536-byte encoder buffer. Due to libjpeg w...
CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...
CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...
Important: Red Hat Security Advisory: rsyslog security update
An update for rsyslog is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory...
CVE-2026-96644
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
CVE-2026-96644
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...