CVE-2026-55193: Heap-based Buffer Overflow

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-63633: Heap-based Buffer Overflow

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

CVE-2026-76889: Heap-based Buffer Overflow

UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76888: Heap-based Buffer Overflow

RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-19508: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the multipart form-data parser in jstpost.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...

CVE-2026-55191: Heap-based Buffer Overflow

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

CVE-2026-49429: Heap-based Buffer Overflow

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...

CVE-2026-75143: Heap-based Buffer Overflow

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

RHEL 9 : gegl04 (RHSA-2026:56963)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56963 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffe...

CVE-2026-76883: Heap-based Buffer Overflow

Catapult DCT2000 file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-58081: Heap-based Buffer Overflow

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

CVE-2026-49430: Heap-based Buffer Overflow

The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...

CVE-2026-75619: Heap-based Buffer Overflow

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RT...

CVE-2026-52834: Heap-based Buffer Overflow

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

SUSE CVE-2026-14610

A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overflow. The attack is restricted to local...

CVE-2026-76034: Heap-based Buffer Overflow

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-76036: Heap-based Buffer Overflow

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-71676: Heap-based Buffer Overflow

Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated...

CVE-2026-76046: Heap-based Buffer Overflow

Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...