3776 matches found
CVE-2026-63633
The FreeRDP software (prior to version 3.28.0 ) is vulnerable to a heap buffer overflow in the Opus audio decode functionality. The root cause is located in libfreerdp/codec/dsp.c, where the freerdp_dsp_decode_opus function calls Stream_EnsureRemainingCapacity even though opus_decode writes decod...
CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...
BIT-GOLANG-2026-56859 Add recursion depth guard during decode in encoding/xml
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-62291 libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
CVE-2026-62291
libheif ≤1.23.0 allows attacker-controlled heap corruption (OOB write/read) via mismatched alpha plane dimensions during decode-and-re-encode. Fixed in 1.23.1; SUSE, openSUSE, and PT Security have issued updates. Exploitation in the wild is not reported. Patch: https://github.com/strukturag/libhe...
CVE-2026-62291 libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
PT-2026-77265
libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock decode function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The...
CVE-2026-62291: Out-of-bounds Read
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...
Linux Distros Unpatched Vulnerability : CVE-2026-72296
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes...
GHSA-MPWR-8VM7-H73F package pkcs12: Authentication bypass in Decode functions
Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...
package pkcs12: Authentication bypass in Decode functions
Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...
CVE-2026-71486
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100737)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100737 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmapdecode When decoding osdstate and osdweight...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100565)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100565 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak on SETACL decode failure nfsaclsvcdecodesetaclargs and...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100551)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100551 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinex...
CVE-2026-72296
In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETHHLEN to be pullable in ifedecode ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to ethtypetrans, which expects the inner...
CVE-2026-72466
Summary of CVE-2026-72466 : In the Linux kernel’s xprtrdma implementation, two path issues in rpcrdma_is_bcall() can leak the receive buffer and drain the Receive queue when decoding a reply. The speculative zero-byte peek uses xdr_inline_decode() without respecting xdr->end, allowing five sub...
