3818 matches found
SUSE CVE-2026-47143
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired and decode when disassembling 3DNow! opcodes 0F 0F in builds compiled with -DCAPSTONEX86REDUCE, allowing a remote attacker to crash any application using the reduced X86...
CVE-2026-48029
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItemGrid::decodegridtile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue...
CVE-2026-48029 libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItemGrid::decodegridtile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue...
CVE-2026-48029
CVE-2026-48029 affects libheif: heap OOB read in ImageItem_Grid::decode_grid_tile due to irot-induced tile-coordinate underflow. Affected versions are 1.19.0–1.21.2; fixed in 1.22.0. Several connected advisories (NVD, Debian, Ubuntu, Amazon Linux, OSV, etc.) cite this along with related issues. R...
CVE-2026-48029 libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItemGrid::decodegridtile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the decodesliceunitWPP function when decoding a WPP HEVC slice. An attacker can cause a read past the end of an allocated vector by crafting PPS/SPS headers so that the computed ctbAddrRS value exceeds the size of...
CVE-2026-45382
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...
CVE-2026-45383
CVE-2026-45383 affects libde265 prior to 1.0.19, where a heap-buffer-overflow can occur during HEVC WPP slice decoding. In decoder_context::decode_slice_unit_WPP(), ctbAddrRS is computed as ctbRow*ctbsWidth and, if PPS/SPS headers encode a value that exceeds pps.CtbAddrRStoTS.size(), an out-of-bo...
CVE-2026-45383 libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...
CVE-2026-45383 libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...
CVE-2026-45382 libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...
CVE-2026-45382
libde265 prior to v1.0.19 contains a heap-buffer-overflow read in decode_slice_unit_tiles caused by unvalidated PPS tile geometry (ctbAddrRS computed from PPS colBd/rowBd without ensuring it fits CtbAddrRStoTS.size() == sps->PicSizeInCtbsY). A malformed PPS that passes set_derived_values but e...
CVE-2026-45382 libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...
CVE-2026-45382
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
Summary @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent without handling decode errors. A single request carrying a malformed percent-encoded value for example a bare % in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any...
SUSE CVE-2026-52584
Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...
libtiff security update
4.4.0-18.1 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 RHEL-189387...
CVE-2026-47143: NULL Pointer Dereference
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired and decode when disassembling 3DNow! opcodes 0F 0F in builds compiled with -DCAPSTONEX86REDUCE, allowing a remote attacker to crash any application using the reduced X86...
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...
