319263 matches found
CVE-2026-45813
CVE-2026-45813 covers an out-of-bounds write and integer underflow in the Apache NimBLE BASS service. The issue arises from improper validation when parsing the BASS service “Add Source” and “Modify Source” PDUs, which can cause a stack buffer overflow or arbitrary out-of-bounds read. It is trigg...
EUVD-2026-48585
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...
CVE-2026-45812
CVE-2026-45812 affects Apache NimBLE up to 1.9.0. When a single Legacy Advertising Report HCI event bundles multiple reports, NimBLE miscalculates the offset to the next report, which can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application....
CVE-2026-45812 Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...
CVE-2026-45812
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...
CVE-2026-45811 Apache NimBLE: Buffer overflow in socket HCI transport
Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...
CVE-2026-45811
Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...
CVE-2026-45811
CVE-2026-45811: Buffer Copy without Checking Size of Input in Apache NimBLE's HCI socket transport allows a buffer overflow because the received HCI event might not fit the configured event pool. Affects NimBLE up to version 1.9.0; upgrade to 1.10.0 to fix. Exploitation requires either a misconfi...
CVE-2026-45811 Apache NimBLE: Buffer overflow in socket HCI transport
Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...
EUVD-2026-48584
Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...
kernel: tipc: fix double-free in tipc_buf_append()
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...
kernel: tipc: fix double-free in tipc_buf_append()
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...
DEBIAN-CVE-2026-56392
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...
CVE-2026-56391
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...
UBUNTU-CVE-2026-56392
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...
UBUNTU-CVE-2026-56391
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...
CVE-2026-56392 Heap-based Buffer Overflow in GNU coreutils
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...
CVE-2026-56392
The CVE describes a heap-based buffer overflow in GNU coreutils unexpand. The root cause is an integer overflow during buffer allocation when processing large tab stop (-t) values, where multiplication for the allocation size can wrap, producing an undersized buffer. As a result, subsequent write...
CVE-2026-56391
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...
CVE-2026-56391 Out‑of‑bounds Read in GNU coreutils
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...