ANT-2026-SC8JK49A · ffmpeg · Heap-buffer-overflow

heap-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-SC8JK49A: Heap-buffer-overflow in ffmpeg FFmpeg's Dira...

CVE-2026-74238

TIER IV Nebula through 1.2.0's Vlp32Decoder::unpack() reads past UDP buffer bounds when a short datagram is sent to the Velodyne port, which lacks sender-address restrictions, leaking heap memory into fabricated PointCloud2 messages consumed by Autoware nodes. No in-the-wild exploitation is docum...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

RLSA-2026:55433 Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI...

Security update for ffmpeg

This update for ffmpeg fixes the following issue: CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

SUSE-SU-2026:3632-1 Security update for ffmpeg

This update for ffmpeg fixes the following issue: - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490...

openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.

A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an...

Important: Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

gstreamer1-plugins-bad-free 1.22.12-7.4 - Fix ADPCM decoder negotiation and input size check CVE-2026-19387 Resolves: RHEL-235496 gstreamer1-plugins-ugly-free 1.22.12-6.2 - Fix integer overflows during bounds checks in asfdemux - Resolves: RHEL-235519...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-091338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091338 advisory. libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the initvlc function, a similar issue to CVE-2013-0868. Tenable has extracted the preceding...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099456 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the...

Oracle Linux 10 : gstreamer1-plugins-bad-free (ELSA-2026-55433)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55433 advisory. - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099487)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099487 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a...

gstreamer1-plugins-bad-free security update

1.26.7-2.7 - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 1.26.7-2.5 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats CVE-2026-59691 Resolves: RHEL-193550 1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves...

7-Zip 26.01 XZ Decoder Heap Buffer Overflow

7-Zip 26.01 contains a heap buffer overflow vulnerability in the XZ decoder that can be triggered while processing a specially crafted XZ archive. This proof of concept generates a malformed XZ file designed to reproduce the crash condition in the vulnerable multi-threaded XZ decompression path...

RHEL 10 : gstreamer1-plugins-bad-free (RHSA-2026:55433)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55433 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099455)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099455 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occur...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099507)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099507 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the X...

The vulnerability of the `rockchip_vpu981_av1_dec_init()` function in the driver/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c file of the Linux operating system’s multimedia device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rockchipvpu981av1decinit function in the driver/media/platform/verisilicon/rockchipvpu981hwav1dec.c file of the Linux operating system’s multimedia device driver is related to incorrect calculation of buffer size. Exploiting this vulnerability could allow an attacker to...