libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...

libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow

A flaw was found in libXfont2. In the BitmapScaleBitmaps function, an integer overflow can occur when calculating the memory needed for font glyphs. This overflow leads to a heap buffer overflow, where a smaller-than-required memory buffer is allocated. A local attacker can exploit this by loadin...

libXfont2: computeProps Property Buffer Heap Buffer Overflow

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server...

libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...

EUVD-2026-53678

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

CVE-2026-19028

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial o...

DEBIAN-CVE-2026-19028

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial o...

UBUNTU-CVE-2026-19028

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial o...

UBUNTU-CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

Linux Distros Unpatched Vulnerability : CVE-2026-19026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at...

The vulnerability of the Views component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially created PDF file...

Linux Distros Unpatched Vulnerability : CVE-2026-19023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a...

Linux Distros Unpatched Vulnerability : CVE-2026-19027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index int...

CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

DEBIAN-CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

DEBIAN-CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

UBUNTU-CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19028

The CVE-2026-19028 vulnerability affects HDF5 up to version 2.3.0, specifically the H5Z__filter_fletcher32 function in H5Zfletcher32.c. The data length used for the checksum is computed by subtracting the 4-byte trailing checksum from the input buffer size without verifying that the buffer is at ...

CVE-2026-19028 HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial o...