39 matches found
CVE-2026-99010
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
CVE-2026-103672
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...
EUVD-2026-105321
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...
CVE-2026-103672
The PEAK-System PCAN Windows drivers from HMS Networks are vulnerable to an Improper Validation of Array Index (CWE-129). The vulnerability exists because the PCAN parser indexes a length table using attacker-controlled DLC without enforcing the required bound of DLC
PT-2026-118633
Name of the Vulnerable Software and Affected Versions PEAK-System PCAN parser affected versions not specified Description The PCAN parser fails to validate the Data Length Code DLC value, allowing it to exceed 0x0f. This lack of enforcement enables an attacker to manipulate the length table index...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: - In can:bcm, the frame length is validated in bcmrxsetup for RTR replies. - In bcmtxsetup, the value of cf-len is checked against the DLC limits of CAN/CAN FD before framing the data for TXSETUP. However, bcmrxsetup never...
PT-2026-91356
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcomm mutex for the deferred setup accept rfcomm sock recvmsg completes a deferred setup by calling rfcomm dlc accept without holding any RFCOMM lock: if test and clear bitRFCOMM DEFER SETUP, &d-flags...
CVE-2026-68188
CVE-2026-68188 : In the Linux kernel Bluetooth RFCOMM path, a race caused use-after-free in rfcomm_send_rpn when rfcomm_tty_set_termios tests dlc->session without holding rfcomm_mutex and the DLC/session is freed by krfcommd. The fix adds rfcomm_dlc_send_rpn() that holds rfcomm_mutex while ver...
EUVD-2026-26697
Buffer overflow vulnerability in Open Vehicle Monitoring System 3 OVMS3 3.3.005. In canformatcanswitch.cpp the parser does not properly validate a CANswitch DLC value, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted CANswitch frames...
UBUNTU-CVE-2024-56604
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcommsockalloc btsockalloc attaches allocated sk object to the provided sock object. If rfcommdlcalloc fails, we release the sk object, but leave the dangling pointer in th...
yt-dlp security vulnerability
yt-dlp is based on the youtube-dl branch of the now inactive youtube-dlc. A security vulnerability exists in yt-dlp that stems from not properly escaping special characters, resulting in a remote code execution vulnerability...
GHSA-8FXR-QFR9-P34W TorchServe Server-Side Request Forgery vulnerability
Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...
GHSA-4MQG-H5JF-J9M7 TorchServe Pre-Auth Remote Code Execution
Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...
TorchServe Pre-Auth Remote Code Execution
Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...
CVE-2023-28543 Out of Bounds read in SNPE Library
A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model e.g. from a remote source...
CVE-2023-28543 Out of Bounds read in SNPE Library
A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model e.g. from a remote source...
CVE-2023-28543: Out-of-bounds Read
A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model e.g. from a remote source...
SUSE CVE-2019-3701
An issue was discovered in cancangwrcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the candlc field. The privileged user "root" with CAPNETADMIN can create a CAN frame modification rule that mak...
osmium-dlc.com Cross Site Scripting vulnerability OBB-3069630
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
dlc-software.com Cross Site Scripting vulnerability OBB-2998327
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...