CVE-2026-8461-EXP

CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV 힙 OOB 쓰기 PoC !WARNING 이 저장소는 힙 손상 취약점에 대한 작동하는 익스플로잇 PoC를 포함하고 있습니다. 이는 승인된 보안 연구, CTF 상황, 방어적 분석 목적으로만 사용됩니다. 자신이 소유하지 않거나 명시적 서면 허가를 받지 않은 시스템에 대해 사용하지 마십시오. 영향: FFmpeg 8.0.1 MagicYUV 디코더 libavcodec/magicyuv.c 원시: 힙 OOB 쓰기 → AVBuffer.free 하이잭 → syste...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32비트 익스플로잇 랩 이 저장소는 nginx 1.30.0에서 CVE-2026-42945를 연구하기 위한 재현 가능한 Docker 실험실입니다. 취약한 32비트 타겟, 기본 트리거, 연구실 지원known-address RCE 검증기, 그리고 내부 조사introspection 없이 작동하는 브루트포스 드라이버를 포함합니다. 증명 경계는 다음과 같습니다: exploit/triggeroob.py는 힙 OOB 쓰기 프리미티브를 시연합니다. exploit/labknownaddress.py는 Dock...

CVE-2026-31431

CVE-2026-31431 — NULLポインタからrootへ：LinuxカーネルのAFALG AEADを悪用する バグクラス: NULLポインタ参照 → ヒープOOB書き込み → 資格情報の上書き 影響を受けるサブシステム: net/alg/afalg.c 影響: ローカル権限昇格（非特権ユーザー → root） 影響を受けるカーネル: Linux 4.4 – 4.9（パッチ適用前） 概要 カーネルがユーザー空間アドレスを期待する場所に、NULLポインタを指定してsetsockoptを呼び出します。カーネルはアドレス0x00000000から読み取ります —...

CVE-2026-32945

CVE-2026-32945 PJSIP DNS圧縮ポインタのヒープ領域外読み取り（リモートDoS） 説明 pjlib-util/src/pjlib-util/dns.c 内の getnamelen と getname は、pjmemcpy&offset, p, 2 を使用して2バイトのDNS圧縮ポインタを読み取りますが、両バイトがパケットバッファ内にあることを確認していません。0xC0 バイト（圧縮ポインタマーカー）がDNS応答の最後のバイトである場合、memcpy はヒープ割り当て境界を1バイト超えて読み取ります。...

MiracleLinux 9 : gstreamer1-plugins-bad-free-1.22.12-7.el9_8.4, gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.2 (AXSA:2026-1666:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1666:01 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 gstreamer:...

CVE-2026-80101

A flaw in GIMP's file-xwd plugin causes a heap out-of-bounds read when processing a specially crafted XWD image file. The root cause is that the plugin validates the image width and bytes-per-line parameters independently, rather than ensuring their combined values are consistent with the allocat...

CVE-2026-59981 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

CVE-2026-68515 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied,...

CVE-2026-68515 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied,...

CVE-2026-59184 OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row return an...

CVE-2026-59184 OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row return an...

CVE-2026-55059 OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

EulerOS Virtualization 2.13.0 : dnsmasq (EulerOS-SA-2026-3210)

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via...

CVE-2026-73066

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

SUSE CVE-2026-74694

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

AZL-97140 CVE-2026-74694 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

CVE-2026-74694

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

EUVD-2026-64381

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

CVE-2026-74694 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

CVE-2026-74694

CVE-2026-74694 is a heap out-of-bounds read in the Linux kernel's net/ncsi subsystem. The function ncsi_send_cmd_nl() trusts the attacker-controlled ncsi_pkt_hdr.length field from the in-band packet header without cross-checking it against the actual readable size of the NCSI_ATTR_DATA netlink at...