26804 matches found
EUVD-2026-102656
The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...
EUVD-2026-102528
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...
CVE-2026-110875
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...
Linux Distros Unpatched Vulnerability : CVE-2026-111273
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse- tar.c, reachable through the arentrygetname API. Attackers can...
Adobe FrameMaker 2022 < 17.0.10.928 (2022.0.10.928) / Adobe FrameMaker 2026 < 18.0.1.312 (2026.0.1.312) Multiple Vulnerabilities (APSB26-172)
The version of Adobe FrameMaker installed on the remote Windows host is prior to Adobe FrameMaker 2022 17.0.10.928 / Adobe FrameMaker 2026 18.0.1.312. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-172 advisory. - Adobe Framemaker is affected by an out-of-bound...
Linux Distros Unpatched Vulnerability : CVE-2026-110875
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds...
UBUNTU-CVE-2026-111458
The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...
UBUNTU-CVE-2026-110875
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...
Red Hat: CVE-2026-62439: gimp: gimp: file-pvr Plug-in PVR File Parsing Integer Overflow Heap-based Buffer Overflow Vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...
CVE-2026-111458
The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...
LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF...
Security Update for Microsoft .NET Core (October 2026)
The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network...
Security Update for Microsoft .NET Core SDK (October 2026)
The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an...
SUSE CVE-2026-110837
FreeRDP 2.0.0 before 3.32.0, when built with WITHLAME=ON and WITHDSPFFMPEG=OFF, has a heap-based buffer overflow in freerdpdspdecodemp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded sampl...
CVE-2026-15176
A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to...
CVE-2026-111273
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...
CVE-2026-108447
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-108448
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...