DEBIAN-CVE-2026-110877

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110874

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110877

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-111167

GNU LibreDWG versions through 0.14.8612 are vulnerable to a global out-of-bounds read in the AcDs decoder 's acds_private() function. The root cause is an unchecked schema property type index , which allows an attacker to read beyond a static table. By supplying a crafted R2004 or R2010+ DWG file...

CVE-2026-111167 GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acdsprivate that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property...

CVE-2026-111165

The libmikmod library (versions through 3.3.15 ) contains a global out-of-bounds read vulnerability in the MultiTracker loader function MTM_Load(). The root cause is a lack of clamping on the module channel count. An attacker can provide a crafted .mtm file with a channel count exceeding 32 to re...

CVE-2026-111165 libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

EUVD-2026-102292

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

CVE-2026-111163

WildMIDI versions through 0.5.0 are vulnerable to a heap out-of-bounds read in the _WM_ParseNewHmi() function located in src/f_hmi.c. The root cause is improper handling of 0xfe sub-events , where a crafted HMI file containing a 0xfe 0x10 sub-event near the buffer end allows an attacker to read u...

EUVD-2026-102290

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in WMParseNewHmi in src/fhmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation,...

CVE-2026-111162 WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...

CVE-2026-111162 WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...

CVE-2026-111162 WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...

EUVD-2026-102286

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewflefextendedattributereaddata because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or lea...

CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

EUVD-2026-102275

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

CVE-2026-111148

The libsidplayfp library, affecting versions up to and including 3.1.1 , is vulnerable to a heap out-of-bounds read via the SidTuneBase::acceptSidTune function. An attacker can crash applications by providing a PSID/RSID file containing an unchecked data offset. By setting the header data offset ...

CVE-2026-111144 libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

EUVD-2026-102270

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer...

EUVD-2026-102261

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files,...