CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV ヒープ OOB 書き込み PoC !WARNING このリポジトリには、ヒープ破壊の脆弱性に対する実動するエクスプロイト PoC が含まれています。 これは、許可されたセキュリティ研究、CTF コンテキスト、および防御的分析のみを目的としています。 自分が所有していないシステム、または明示的な書面による許可を得ていないシステムに対して使用しないでください。 影響を受けるバージョン: FFmpeg 8.0.1 MagicYUV デコーダー libavcodec/magicyuv.c プリミティブ: ヒ...

CVE-2026-31431

CVE-2026-31431 — NULLポインタからrootへ：LinuxカーネルのAFALG AEADを悪用する バグクラス: NULLポインタ参照 → ヒープOOB書き込み → 資格情報の上書き 影響を受けるサブシステム: net/alg/afalg.c 影響: ローカル権限昇格（非特権ユーザー → root） 影響を受けるカーネル: Linux 4.4 – 4.9（パッチ適用前） 概要 カーネルがユーザー空間アドレスを期待する場所に、NULLポインタを指定してsetsockoptを呼び出します。カーネルはアドレス0x00000000から読み取ります —...

CVE-2026-32945

CVE-2026-32945 PJSIP DNS圧縮ポインタのヒープ領域外読み取り（リモートDoS） 説明 pjlib-util/src/pjlib-util/dns.c 内の getnamelen と getname は、pjmemcpy&offset, p, 2 を使用して2バイトのDNS圧縮ポインタを読み取りますが、両バイトがパケットバッファ内にあることを確認していません。0xC0 バイト（圧縮ポインタマーカー）がDNS応答の最後のバイトである場合、memcpy はヒープ割り当て境界を1バイト超えて読み取ります。...

CVE-2026-81884

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81882

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

EUVD-2026-84468

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81881

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical inde...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32-bit エクスプロイト実験環境 このリポジトリは、nginx 1.30.0 における CVE-2026-42945 を研究するための再現可能な Docker ラボです。脆弱な 32 ビットターゲット、プリミティブトリガー、ラボ支援型の既知アドレス RCE バリデータ、および内部情報を使用しないブルートフォースドライバが含まれています。 証明の境界が重要です: exploit/triggeroob.py は、ヒープ OOB 書き込みプリミティブを示します。 exploit/labknownaddress.py は、Docker 内で RCE...

Important: Red Hat Security Advisory: rust security update

An update for rust is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Linux Distros Unpatched Vulnerability : CVE-2026-63638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, a...

Linux Distros Unpatched Vulnerability : CVE-2026-63419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, a...

CVE-2026-92382

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

CVE-2026-63638

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open maps it to a 32-bit imagespec,...

DEBIAN-CVE-2026-63422

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads...

CVE-2026-63419

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel...

CVE-2026-63422

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads...

UBUNTU-CVE-2026-63422

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads...

CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-84448

libheif , a HEIF and AVIF file format decoder/encoder, contains a heap out-of-bounds read in its region writer API prior to version 1.23.2 . The function heif_region_item_add_region_inline_mask_data() in heif_regions.cc accepts a mask_data_len parameter without verifying it matches the byte count...

CVE-2026-67549 OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...