CVE-2026-63273

LibreOffice Draw is vulnerable to a heap buffer overflow when importing encrypted PDF documents. The root cause lies in the PDF import's encryption handling: the decryption key length was read directly from the document's own encryption dictionary and used to fill a fixed-size key buffer without ...

EUVD-2026-84353

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length large...

CVE-2026-63272 Heap buffer overflow in WMF text record import

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...

EUVD-2026-84352

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...

CVE-2026-63272 Heap buffer overflow in WMF text record import

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...

CVE-2026-63272

LibreOffice is affected by a heap buffer overflow in its WMF text record import functionality. When a WMF text record carries its own character advance widths, the count of advance values and the text length are read independently from the file with no validation that they agree. During rendering...

postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists

A flaw was found in PostgreSQL pgdump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating...

postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead ...

CVE-2026-95516

A flaw was found in the ZBar barcode reader library. A heap-buffer-overflow write of one byte occurs when processing Structured-Append QR codes where the buffer size calculation does not account for NUL separator bytes inserted between decoded segments. An attacker could exploit this by crafting ...

CVE-2026-95508

libslirp , a userspace network stack, contains a heap-based buffer overflow in its DHCPv6 and TFTP response builders. When the host is configured with a small interface MTU (below the IPv6 minimum link MTU of 1280), a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the r...

CVE-2026-95508 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...

DEBIAN-CVE-2016-15059

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...

CVE-2016-15059

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...

UBUNTU-CVE-2016-15059

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...

CVE-2016-15059 Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...

CVE-2016-15059

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...

CVE-2016-15059

The Net::IDN::Punycode module for Perl, specifically versions before 2.301 , is vulnerable to a heap buffer overflow in the XS backend . The flaw exists within the encode_punycode function, where the loop fails to check for sufficient space before writing the last digit of a round and the termina...

CVE-2016-15059 Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...