pypdf: Possible large memory usage for wrong image dimensions

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consid...

kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...

GHSA-8HG6-C449-896M Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...

CVE-2026-65650

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...

CVE-2026-65650

CVE-2026-65650 affects Elgg before 7.0.0, where image dimension checks are missing, enabling a denial-of-service via oversized avatar uploads. Impact: possible availability degradation (CVSS 4.3). Remediation: upgrade to Elgg 7.0.0 or later where the issue is addressed, as reflected in the 7.0.0 ...

CVE-2026-65650

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...

CVE-2026-65650

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...

PT-2026-63554

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf is susceptible to a Denial of Service DoS attack via resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document containing ...

PT-2026-63553

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf fails to validate the dimensions of BMP images before processing them. The software relies solely on the declared header dimensions to allocate memory for the image canvas via the...

GHSA-PHJ9-MV4W-65PM Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Description PIL/GdImageFile.py GdImageFile.open reads image dimensions from the GD 2.x header and stores them in self.size without calling Image.decompressionbombcheck. Because GdImageFile is not registered with Image.registeropen, it never passes through the standard Image.open code path that...

EUVD-2026-41902

Pillow BdfFontFile: Image.new called without decompressionbombcheck — bomb protection bypass via font loading...

GHSA-45HQ-CXWH-F6VC Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1...

CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1...

CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow

libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...

CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow

libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...

PT-2026-61632

libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...

SUSE-SU-2026:22817-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12891: unchecked aspectratioidc value used as an array index in the H.266 parser could cause a global out- of-bounds read bsc1268872. - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser...

CVE-2026-56741 JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS in TelnetIO.java:856-879 reads client-supplied...