ANT-2026-WG9N02WM · libjxl · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-WG9N02WM: Heap buffer overflow in fast...

wasm3:fuzzer: Global-buffer-overflow in CompileCallArgsAndReturn

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=4617187848159232 Project: wasm3 Fuzzing Engine: afl Fuzz Target: fuzzer Job Type: aflasanwasm3 Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x598144056448 Crash State:...

zxc:zxc_fuzzer_decompress: Global-buffer-overflow in zxc_decompress_chunk_wrapper_default

Project: https://github.com/hellobertrand/zxc.git Detailed Report: https://oss-fuzz.com/testcase?key=5141221035802624 Project: zxc Fuzzing Engine: afl Fuzz Target: zxcfuzzerdecompress Job Type: aflasanzxc Platform Id: linux Crash Type: Global-buffer-overflow READ 16 Crash Address: 0x5769f10dc90c...

CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

JLSEC-2026-951 ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger ...

ffmpeg:ffmpeg_AV_CODEC_ID_DCA_DEC_fuzzer: Global-buffer-overflow in ff_dca_set_channel_layout

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6461594058686464 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDDCADECfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type:...

PT-2026-76342

The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger ...

libreoffice:sftfuzzer: Global-buffer-overflow in CffContext::getBaseAccent

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=6133479361019904 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: sftfuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash...

TencentOS Server 2: freerdp (TSSA-2026:0753)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0753 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

OESA-2026-2997 gzip security update

gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz. Security Fixes: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

wasm3:fuzzer: Global-buffer-overflow in Compile_Memory_CopyFill

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=5870879456952320 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerasanwasm3 Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x584c6a4b94a8 Cras...

Updated gzip package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Predictable Temporary File in GNU gzip. CVE-2026-41991 Global Buffer Overflow in GNU gzip. CVE-2026-41992...

OSV-2026-1026 Global-buffer-overflow in txt2sd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530698821 Crash type: Global-buffer-overflow READ 1 Crash state: txt2sd fuzzmdnsxht.cc...

PT-2026-59008

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530698821 Crash type: Global-buffer-overflow READ 1 Crash state: txt2sd fuzz mdns xht.cc...

open62541:fuzz_mdns_xht: Global-buffer-overflow in txt2sd

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=5900753060036608 Project: open62541 Fuzzing Engine: afl Fuzz Target: fuzzmdnsxht Job Type: aflasanopen62541 Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

CVE-2026-7840

CVE-2026-7840 (UltraVNC repeater) : A global buffer overflow in the embedded HTTP administration server affects UltraVNC repeater versions up to 1.8.2.2. The functions wi_senderr() and wi_replyhdr() copy the caller-supplied HTTP request URI into a fixed 1000-byte buffer (hdrbuf) using unchecked s...

Global Buffer Overflow in GNU gzip

...

CVE-2026-41992

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression...

CVE-2026-41992

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression...

CVE-2026-41992

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression...