CVE-2026-105826

ImageMagick versions before 6.9.13-55 and 7.x before 7.1.2-30 are vulnerable to a security policy bypass within the MAT decoder . The root cause is the decoder's failure to enforce configured temporary file size limits when processing highly compressed data. An attacker can provide a crafted MAT ...

pgpdump

pgpdump: a PGP packet visualizer Kazu Yamamoto [email protected] August 16, 2010 Overview pgpdump is a PGP packet visualizer which displays the packet format of OpenPGP RFC 4880 and PGP version 2 RFC 1991. Here is an example: % pgpdump test/sig1 Old: Marker Packettag 103 bytes String -...

Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

CVE-2023-38831 Reverse Shell Demonstration This repository contains a PDF summary and screenshots of a lab-based demonstration of CVE-2023-38831. The vulnerability allows attackers to embed and execute malicious payloads in compressed files. In this case, the payload triggers a reverse shell...

miteru

This repository does not have a README...

plugxdecoder

plugxdecoder Basic Python script which Decodes PlugX traffic and encrypted/compressed artifacts. Accepting pull requests from those who wish to contribute. Currently requires: CTypes with ntdll, dpkt http://code.google.com/p/dpkt Tested with Python 2.7, on Windows. Long-term goal is to make a pur...

CVE-2025-0411-PoC

更多PoCs at: https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X Compile with MinGW-w64 x8664-w64-mingw32-g++ loader.cpp -o loader.exe -s -static After compilation, compress the exe with 7z and execute twice. Since this vulnerability requires user interaction, the generated compressed file needs...

EUVD-2026-93862

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError...

CVE-2026-106565

A flaw was found in ImageMagick. A remote attacker could trigger a Denial of Service DoS by providing a specially crafted bzip2-compressed image file. Due to a missing End-of-File EOF check during image decompression, the application can enter an infinite loop, exhausting system resources and...

GHSA-4V53-57PG-C464 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Summary LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap. Details In...

DEBIAN-CVE-2026-106565

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-...

CVE-2026-106565 ImageMagick: Infinite Loop in bzip2 compressed images.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-...

EUVD-2026-94380

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-...

CVE-2026-106565

The ImageMagick image manipulation software contains a vulnerability where a missing end-of-file check while processing bzip2-compressed image data can trigger an infinite loop . This flaw allows for the exhaustion of processing resources , potentially impacting system availability. The issue is ...

CVE-2026-106565 ImageMagick: Infinite Loop in bzip2 compressed images.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-...

CVE-2026-106449

A flaw was found in lz4-java. This issue can lead to a Denial of Service DoS when the LZ4 input stream is configured not to stop upon encountering empty blocks. In this non-default configuration, consecutive empty blocks are processed via recursive calls rather than iterative handling. A remote...

CVE-2026-106452

A flaw was found in lz4-java. A remote attacker can trigger a Denial of Service DoS by providing a crafted compressed data stream with an oversized block header. During decompression, the input stream allocates memory based on this attacker-controlled size field before reading the actual payload,...

Linux Distros Unpatched Vulnerability : CVE-2026-106449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles ea...

DEBIAN-CVE-2026-106452

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2026-106452

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2026-106452

The yawkat LZ4 Java library (prior to version 1.11.2 ) is vulnerable to a heap exhaustion issue in the net.jpountz.lz4.LZ4BlockInputStream.refill() function. The vulnerability occurs because the application validates that the compressedLen field in a legacy LZ4Block header is nonnegative but fail...