PT-2026-111984

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791568721)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791568721 advisory. - FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the...

Stable Channel Update for Desktop

The Stable channel has been updated to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

Microsoft Windows: CVE-2026-69471: Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

Security Vulnerabilities fixed in Thunderbird 158 — Mozilla

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data...

Windows-CVE-2024-38063

Windows CVE-2024-38063 CVE ID: CVE-2024-38063 CVSS 3.1 Score: 9.8 Critical EPSS Score: Low - 0.088% https://www.cvedetails.com/epss/CVE-2024-38063/epss-score-history.html Impact: Remote Code Execution Affected Components: Windows TCP/IP stack Attack Vector: Network Remote Vulnerability Details...

EUVD-2026-98095

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-85457

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-85457 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-85457

IBM Planning Analytics versions 2.0 and 2.1 are affected by a stack-based buffer overflow (CWE-121). This vulnerability could allow a remote authenticated attacker to perform arbitrary code execution . No specific exploit details or remediation instructions are provided in the documents.

CVE-2026-53922

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

AZL-108060 CVE-2026-103658 affecting package aspell 0.60.8.1-1

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

DEBIAN-CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

UBUNTU-CVE-2026-103658

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

Important: Red Hat Security Advisory: gd security update

An update for gd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

libgd: buffer overflow when processing specially crafted GIF file

A flaw was found in libgd. Processing a specially crafted GIF file allows a remote attacker to trigger a buffer overflow, resulting in an application crash and a denial of service. Arbitrary code execution is possible in theory, but considered highly unlikely because standard image decompression...

CVE-2026-103658

A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service DoS by convincing a user to process a specially crafted dictionary file. This issue occurs due to an integer calculation error during buffer capacity checks in the read-only dictionary...