Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size

============================================================================ ANT-2026-CS7N494P high CWE-787 memory-safety Heap buffer overflow saving TIFF with libtiff when tags override image size Location: src/libImaging/TiffDecode.c:1035 in ImagingLibTiffEncode Commit:...

CVE-2026-128067

The Pillow Python imaging library (versions 2.3.0 through 12.3.0 ) is vulnerable to a heap buffer overflow when saving compressed TIFF images using libtiff . The root cause is that the TiffImagePlugin._save path allows attacker-controlled image geometry tags (such as ImageWidth, ImageLength, or S...

CVE-2026-128067 Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size

Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin.save...

EUVD-2026-124778

Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin.save...

CVE-2008-5416

CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin Memory Corruption via SQL Injection A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows...

libwebp-checker

中文 | EN CVE-2023-4863 libwebp dependency check tools This tool checks if your server's application or process that is affected by CVE-2023-4863 libwebp Heap buffer overflow Version above 0.5.0. Run this script in your production environment carefully. Result Screen Shot Scan Result Table of...

CVE-2022-30114

Fastweb FastGate 'cmproxy' buffer overflow CVE-2022-30114 Introduction This script is a Proof of Concept PoC of CVE-2022-30114 and causes a reboot of Fastweb FastGate home routers, both GPON and VDSL2 version. CVE-2022-30114 is a heap-based buffer overflow in the 'cmproxy' executable, a program...

CVE-2021-3156

CVE-2021-3156 Note: These instructions are my own and notes from a stream that I did. If anything is wrong, then let me know. Trust official sources first! Hello everyone, A couple of days back, a serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user...

CVE-2018-4407

CVE-2018-4407 Massive IOS/MAC Attack Exploit CVE-2018-4407 is a Simple and Very Fast BOF attack Against IOS/MAC that can lead to DOS. The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones,...

CVE-2025-50360

Heap Buffer Overflow in Pepper Language Pepper Language is a fast interpreted programming language for simplicity and verbosity. It is dynamically typed and supports garbage collection. Affected Version: Version 0.1.1 and before, Commit 961a5d9988c5986d563310275adad3fd181b2bb7 and before. Status:...

CVE-2026-116317

PostgreSQL contains a heap-based buffer overflow in the ts_rank_cd() function. This vulnerability occurs when processing an invalid tsvector containing duplicate positions, which could allow a database user to execute arbitrary code as the operating system user running the database. The issue aff...

CVE-2026-116317 PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code

Heap-based buffer overflow in PostgreSQL tsrankcd may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected...

CVE-2026-116315

A heap-based buffer overflow exists in the PostgreSQL tsvector_delete() function. The vulnerability is triggered by a tsvector whose lexeme data uses a nonstandard but valid ordering, necessitating additional alignment padding in the result. This flaw allows a database user to execute arbitrary c...

CVE-2026-116315 PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code

Heap-based buffer overflow in PostgreSQL tsvectordelete allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions...

CVE-2023-4683-Test

CVE-2023-4683-Test This repo holds an easy to use POC for CVE-2023-4683. Just git clone this repo and either extract webp-test or run setup-webp-test.sh. webp-test already has the necessary files git commit 7ba44f80f3b94fc0138db159afea770ef06532a0 of https://chromium.googlesource.com/webm/libwebp...

CVE-2024-12084

CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths s2length in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH 16 bytes, an attacker can write out of bounds in the sum2 buffer. How...

CVE-2025-54574-Squid-Heap-Buffer-Overflow

CVE-2025-54574-Squid-Heap-Buffer-Overflow Vulnerability Found on Squid Proxy. CVE-2025-54574 — Critical Heap Buffer Overflow in Squid Proxy This repository documents the discovery, analysis, and responsible disclosure process of CVE-2025-54574, a critical heap-based buffer overflow in Squid 6.4...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

CVE-2026-38427

CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...