CVE-2026-88355

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in newexpr. For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeofteexpr but treats the returned allocation as a complete teexpr...

CVE-2026-88355

A vulnerability exists in tinyexpr (commit 4a7456e) within the new_expr() function due to an incorrect buffer size calculation . For arity-0 expression nodes, such as constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the result a...

EUVD-2026-86286

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in newexpr. For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeofteexpr but treats the returned allocation as a complete teexpr...

ROS-20260923-73-0006

The vulnerability of the sctpgetsockoptpeerauthchunks function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation is related to an incorrect calculation of the buffer size. Exploiting this vulnerability could allow a attacker to compromise the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002316 advisory. Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. Tenable has extracted the preceding description block directly from the Unity...

ROS-20260918-73-0120

The vulnerability of the scarlett2usbgetconfig function in the sound/usb/mixerscarlett2.c module, which supports USB audio devices in Linux operating systems, is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-89608: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

Windows iSCSI Remote Code Execution Vulnerability

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

PT-2026-87600

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

CVE-2026-69598: Incorrect Calculation of Buffer Size

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

CVE-2026-78221

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs...

EUVD-2026-72276

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs...

ROS-20260907-73-0040

The vulnerability in ffmpeg is related to incorrect calculation of buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-80551

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full...

CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093: Incorrect Calculation of Buffer Size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

PT-2026-72712

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...

CVE-2026-51259

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-31515)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505565; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-31416)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505684; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...