CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

CVE-2026-54522 affects MessagePack for Ruby prior to 1.8.2, where MessagePack::Buffer#clear can leave internal rmem pointers stale after a chunk return, enabling a subsequent Buffer#write to alias the freed page and potentially disclose or corrupt cross-buffer data. Root cause: stale rmem_last/rm...

CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

SUSE CVE-2026-64558

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

SUSE CVE-2026-64559

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

JLSEC-2026-954 ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field

Summary A stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. ================================================================= ==3537074==ERROR: AddressSanitizer: stack-buffer-overflow on...

JLSEC-2026-957 ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption

A signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed...

JLSEC-2026-1043 ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex...

ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting a...

JLSEC-2026-951 ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger ...

JLSEC-2026-1082

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

JLSEC-2026-820

Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb...

CVE-2026-64412

A flaw was found in the Linux kernel's netfilter ebtables component. A local attacker could exploit this vulnerability by providing a specially crafted module name that is not properly null-terminated. This improper string handling could lead to a buffer over-read when the requestmodule function...

CVE-2026-62343

A flaw was found in ImageMagick, a widely used software for editing and manipulating digital images. A local user could provide a specially crafted, invalid kernel during a morphology operation. This action could trigger a heap buffer over-write, leading to a denial of service DoS for the...

CVE-2026-62363

A flaw was found in ImageMagick. A local attacker with low privileges could cause a heap buffer over-write by passing a specially crafted argument to the 'fx' operation. This could lead to a denial of service...

Security update for xen

This update for xen fixes the following issues CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. CVE-2026-62426,CVE-2026-62427: sysctl and platform-op...

SUSE-SU-2026:3423-1 Security update for xen

This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. - CVE-2026-62426,CVE-2026-62427: sysctl and...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument bsc1272582. CVE-2026-62946: integer overflo...

SUSE-SU-2026:3412-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bi...