DEBIAN-CVE-2026-77652

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

CVE-2026-77652 Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

EUVD-2026-66675

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

CVE-2026-77652

A heap-based buffer overflow in the Dia diagram editor's WPG file importer (plug-ins/wpg/wpg-import.c ) allows out-of-bounds writes into a fixed 256-entry color palette. The WPG_COLORMAP record handler validates the start index only against the WPG record size, not the palette capacity, so a craf...

CVE-2026-14664

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...

CVE-2026-80568

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80570

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

AZL-97703 CVE-2026-80570 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

AZL-97686 CVE-2026-80568 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80568

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

UBUNTU-CVE-2026-80570

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

CVE-2026-80570

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

CVE-2026-80570 Input: synaptics-rmi4 - zero report size on F54 work error

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

CVE-2026-80570

CVE-2026-80570 is a heap buffer overflow in the Linux kernel's synaptics-rmi4 input driver. In rmi_f54_work(), an error during report request or command verification jumped to the error label, bypassing the abort label where f54->report_size was normally zeroed. The stale payload size then cau...

CVE-2026-80570 Input: synaptics-rmi4 - zero report size on F54 work error

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

CVE-2026-80568

This Linux kernel vulnerability affects the synaptics-rmi4 input driver. When the diagnostic report type is changed mid-stream via VIDIOC_S_INPUT , the report size can change while V4L2 buffers remain allocated at their original stream-start size, leading to a heap buffer overflow if the new size...

CVE-2026-80568 Input: synaptics-rmi4 - block s_input when F54 queue is busy

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80568 Input: synaptics-rmi4 - block s_input when F54 queue is busy

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-19385

A flaw was found in PostgreSQL pgdump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating...

FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...