CVE-2026-89724

CVE-2026-89724 is an out-of-bounds write in the Linux kernel's media: vicodec FWHT encoder. The function vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer using pixfmt_fwht.sizeimage_mult of 3, but for 4-component pixel formats where all planes are full resolution, the unencoded fallback pa...

CVE-2026-89724 media: vicodec: fix out-of-bounds write in FWHT encoder

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

EUVD-2026-76636

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

ImageMagick < 6.9.13-55 / 7.x < 7.1.2-26 Memory Leak

The remote host has a version of ImageMagick installed that is prior to 6.9.13-55, or 7.x prior to 7.1.2-26. It is, therefore, affected by a vulnerability. - ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the...

CVE-2026-89724: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

libaom:av1_enc_fuzzer: Crash in aom_compute_flow_at_point_c

Detailed Report: https://oss-fuzz.com/testcase?key=5864737481752576 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1encfuzzer Job Type: libfuzzermsanlibaom Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7d321e1b7190 Crash State: aomcomputeflowatpointc...

libaom:av1_enc_fuzzer: Heap-buffer-overflow in get_window_wiener_var

Detailed Report: https://oss-fuzz.com/testcase?key=6636186354122752 Project: libaom Fuzzing Engine: honggfuzz Fuzz Target: av1encfuzzer Job Type: honggfuzzasanlibaom Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7acfd65ee430 Crash State: getwindowwienervar...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3300)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...

[SECURITY] [DLA 4774-1] aom security update

Debian LTS Advisory DLA-4774-1 [email protected] https://www.debian.org/lts/security/ Andreas Henriksson September 06, 2026 https://wiki.debian.org/LTS Package : aom Version : 3.6.0-1+deb12u3 CVE ID : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211 Debian Bug : 1140428...

[SECURITY] Fedora 45 Update: libheif-1.23.3-2.fc45

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

SUSE CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

The vulnerability of the FTXT encoder in the console-based image editing tool ImageMagick allows a hacker to trigger a service failure.

The vulnerability of the FTXT encoder in the console-based image editing tool ImageMagick relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ASHLAR encoder in the console-based graphic editor ImageMagic, related to incorrect restrictions on the path name to the directory, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the ASHLAR encoder in the console-based ImageMagick graphics editor is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

The vulnerability of the PNG encoder in the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure.

The vulnerability of the PNG encoder in the console-based graphic editor ImageMagick is related to the lack of memory release after the effective lifespan of the module. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ASHLAR encoder in the console-based graphic editor ImageMagic allows a hacker to trigger a service failure.

The vulnerability of the ASHLAR encoder in the console-based ImageMagick graphics editor is related to the lack of memory release after the effective lifespan of the encoder. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21635-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21635-1 advisory. - CVE-2026-56365: memory leak in the PNG encoder when writing MNG images bsc1270004. - CVE-2026-62343: heap buffer overwrite in morphology...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.9 Vulnerability Details CVEID:CVE-2026-54058 DESCRIPTION: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path,...

SUSE CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...