CVE-2026-102635 ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image...

CVE-2026-97688 urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

CVE-2026-97688 urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

CVE-2026-102360

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...

CVE-2026-442_

CVE protobuf.js CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44294, CVE-2026-44295 - protobuf.js ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testin...

CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...

CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...

EUVD-2026-88818

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...

CVE-2026-8461

🎬 CVE-2026-8461 — PixelSmash Critical Out-of-Bounds Write in FFmpeg MagicYUV Decoder A malicious video file can become a weapon. PixelSmash is a critical memory corruption vulnerability affecting FFmpeg's MagicYUV decoder that allows an attacker to trigger an out-of-bounds write , resulting in...

CVE-2026-97581

A flaw was found in the Linux kernel's Hantro video decoder driver. When processing High Efficiency Video Coding HEVC video streams, the driver fails to validate the number of tile rows and columns against the allocated buffer capacity. A local attacker could exploit this vulnerability by...

CVE-2026-97578

A flaw was found in the Linux kernel's Verisilicon Rockchip AV1 video decoder driver. A local user could exploit this vulnerability by submitting a specially crafted video stream with invalid tile parameters. This flaw can trigger a division-by-zero error or an out-of-bounds write to memory,...

CVE-2026-97577

A flaw was found in the Linux kernel's Verisilicon Rockchip AV1 video decoder driver. A local attacker can exploit this vulnerability by submitting a specially crafted AV1 video frame that specifies more tiles than provided by userspace or supported by hardware limits. This lack of bounds...

CLEANSTART-2026-MM56894 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

EUVD-2026-88558

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...

EUVD-2026-88556

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not...

Linux Distros Unpatched Vulnerability : CVE-2026-100889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder...

CVE-2026-97688: Loop with Unreachable Exit Condition

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

Linux Distros Unpatched Vulnerability : CVE-2026-102635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in...

Amazon Linux 2 : ImageMagick (ALAS-2026-3939)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3939 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions...

CVE-2026-101205

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...