366 matches found
CVE-2026-31431
CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...
CVE-2026-32945
CVE-2026-32945 PJSIP DNS Compression Pointer Heap OOB Read Remote DoS Description getnamelen and getname in pjlib-util/src/pjlib-util/dns.c read a 2-byte DNS compression pointer via pjmemcpy&offset, p, 2 without checking that both bytes lie within the packet buffer. When a 0xC0 byte compression...
CVE-2026-8461-EXP
CVE-2026-8461 "PixelSmash" — FFmpeg MagicYUV Heap OOB Write PoC !WARNING This repository contains a working exploit PoC for a heap corruption vulnerability. It is intended solely for authorized security research, CTF contexts, and defensive analysis. Do not use against systems you do not own or...
DEBIAN-CVE-2026-98407
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
CVE-2026-98407
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
CVE-2026-98407
The Linux kernel contains a heap Out-of-Bounds (OOB) write vulnerability in the wifi: rsi component. The issue occurs within the rsi_hal_load_key() function when a key is removed (where data == NULL). Because the set_key pointer is typed as struct rsi_set_key *, the subscripting operation scales ...
EUVD-2026-101056
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
CVE-2026-98407
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
CVE-2026-98407
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
cve-2026-42945-nginx32-lab
CVE-2026-42945 nginx 32-bit Exploit Lab This repository is a reproducible Docker lab for studying CVE-2026-42945 in nginx 1.30.0. It contains a vulnerable 32-bit target, a primitive trigger, a lab-assisted known-address RCE validator, and a no-introspection brute-force driver. The proof boundary...
AZL-106736 CVE-2026-107570 affecting package mutt 2.2.12-1
heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...
DEBIAN-CVE-2026-107570
heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...
CVE-2026-107570
heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...
EUVD-2026-94853
heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...
CVE-2026-107570
heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...
CVE-2026-107570
The mutt mail client is vulnerable to a heap out-of-bounds (OOB) write in the convert_file_from_to() function. This issue can be triggered by providing a crafted Content-Type header when an email is being used as a template. The vulnerability is characterized as a Use of Out-of-range Pointer Offs...
