libexpat 2.6.2 XML_ParseBuffer Negative Length

libexpat versions prior to 2.6.3 do not reject negative lengths passed to XMLParseBuffer. This proof of concept compiles a small harness and demonstrates the condition against version 2.6.2. https://packetstorm.news/download/237528...

Red Hat: CVE-2026-116149: ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption...

PT-2026-123001

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-58 ImageMagick versions prior to 7.1.2-33 Description A heap-based buffer overflow occurs during the X11 animate operation when processing specially crafted images. A heap-based buffer overflow is a memory...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2026-3294)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3294 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the...

Amazon Linux 2023 : qemu, qemu-common, qemu-guest-agent (ALAS2023-2026-3241)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3241 advisory. hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE:...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-3263)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3263 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the...

Amazon Linux 2023 : cyrus-sasl, cyrus-sasl-devel, cyrus-sasl-gs2 (ALAS2023-2026-3290)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3290 advisory. A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST- MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5...

AlmaLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (ALSA-2026:88164)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

ncurses: Fix of 2 CVEs

CVE-2021-39537: fix heap buffer overflow in nccaptoinfo with a crafted termcap entry - CVE-2023-29491: ignore terminfo/termcap environment variables in setuid/setgid programs --disable-root-environ...

Exploit for Heap-based Buffer Overflow in Google Chrome

CVE-2026-110152 — Chrome ANGLE vertex-attribute translation he...

RLSA-2026:88477 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: calipso: Don't call calipso functions for AFINET sk. CVE-2025-38147 kernel: ipv4: raw: reject IPHDRINCL packets with ihl 5 CVE-2026-64114 kernel: net/smc: reject CHID-0 ACCEPT that matche...

CVE-2026-116014 open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType

open62541 1.5.0 before 1.5.7 contains an integer overflow in UADataTypefromStructureDescription that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UAClientgetRemoteDataTypes, causing decodeBinaryStructure to...

CVE-2026-116014

The open62541 library (versions 1.5.0 before 1.5.7 ) is vulnerable to an integer overflow within the UA_DataType_fromStructureDescription() function. The flaw occurs when the 16-bit memSize field is wrapped during the processing of large custom structure definitions. A malicious OPC UA server can...

CVE-2026-116014 open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType

open62541 1.5.0 before 1.5.7 contains an integer overflow in UADataTypefromStructureDescription that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UAClientgetRemoteDataTypes, causing decodeBinaryStructure to...

CLSA-2026-1792767913 freerdp: Fix of CVE-2026-55193

CVE-2026-55193: fix heap buffer overflow in the TS Gateway RPC client; ensure remaining capacity in rpcchannelread and reject bindack fragment sizes above 0x0FF8...

CLSA-2026-1792819460 tigervnc: Fix of 3 CVEs

CVE-2026-93517: GLX RenderLarge copied client dataBytes into a buffer sized by the smaller embedded cmdlen, allowing a heap buffer overflow - CVE-2026-93518: XKB sizesyms/numsyms/sizeacts/numacts were 16-bit, so resize computations truncated and caused undersized allocations and heap overflow -...

CLSA-2026-1792806631 ncurses: Fix of 2 CVEs

CVE-2021-39537: fix heap buffer overflow in nccaptoinfo with a crafted termcap entry - CVE-2023-29491: ignore terminfo/termcap environment variables in setuid/setgid programs --disable-root-environ...

Important: cyrus-sasl

Issue Overview: A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping specia...

SUSE SLES15 Security Update : kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4889-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4889-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.78 fixes various security issues: The following security issues were fixed: -...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143718)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143718 advisory. phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose...