CVE-2026-5450: Heap-based Buffer Overflow

Calling the scanf family of functions with a %mc malloc'd character match in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow...

CVE-2026-32135: Heap-based Buffer Overflow

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the uriparamparse function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys an...

PT-2026-33804

Name of the Vulnerable Software and Affected Versions KissFFT versions prior to commit 8a8e66e Description An integer overflow occurs in the kiss fftndr alloc function within kiss fftndr.c. The allocation size calculation dimOtherdimReal+2sizeofkiss fft scalar overflows signed 32-bit integer...

ffmpeg:ffmpeg_BSF_DTS2PTS_fuzzer: Heap-buffer-overflow in cmp_insert

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6032368162111488 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFDTS2PTSfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type:...

openexr:openexr_exrcorecheck_fuzzer: Heap-buffer-overflow in DwaCompressor_uncompress

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5998038220079104 Project: openexr Fuzzing Engine: afl Fuzz Target: openexrexrcorecheckfuzzer Job Type: aflasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Cras...

skcms:iccprofile_transform: Heap-buffer-overflow in skcms_private::baseline::clut

Project: https://skia.googlesource.com/skcms.git Detailed Report: https://oss-fuzz.com/testcase?key=4775888633004032 Project: skcms Fuzzing Engine: libFuzzer Fuzz Target: iccprofiletransform Job Type: libfuzzerasani386skcms Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

md4c:fuzz-mdhtml: Heap-buffer-overflow in enter_block_callback

Project: https://github.com/mity/md4c.git Detailed Report: https://oss-fuzz.com/testcase?key=6312313526484992 Project: md4c Fuzzing Engine: afl Fuzz Target: fuzz-mdhtml Job Type: aflasanmd4c Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x7876a97e00bc Crash State:...

MGASA-2026-0102 Updated gdk-pixbuf2.0 packages fix security vulnerability

Denial of service via heap-based buffer overflow when processing a specially crafted jpeg image. CVE-2026-5201...

libvips:vips_fuzzer: Heap-buffer-overflow in vips_stdif_generate

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5109269497446400 Project: libvips Fuzzing Engine: afl Fuzz Target: vipsfuzzer Job Type: aflasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x750f7bcff161 Crash...

freerdp:TestFuzzNTLMMessage: Heap-buffer-overflow in winpr_Data_Get_UINT32

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=4961453902987264 Project: freerdp Fuzzing Engine: libFuzzer Fuzz Target: TestFuzzNTLMMessage Job Type: libfuzzerasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2026-40494 SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in tga.c has an asymmetric bounds check vulnerability. The run-packet path line 297 correctl...

CVE-2026-40494

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in tga.c has an asymmetric bounds check vulnerability. The run-packet path line 297 correctl...

CVE-2026-40493

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel bpp from raw header fields channels depth, but the pixel buffer is allocated base...

RockyLinux 10 : freerdp (RLSA-2026:8458)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8458 advisory. FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data CVE-2026-33984 FreeRDP: FreeRDP: Denial of Service via...

CVE-2026-40493: Out-of-bounds Write

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel bpp from raw header fields channels depth, but the pixel buffer is allocated base...

freerdp:TestFuzzNTLMMessage: Heap-buffer-overflow in ntlm_read_ChallengeMessage

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=6052045370228736 Project: freerdp Fuzzing Engine: honggfuzz Fuzz Target: TestFuzzNTLMMessage Job Type: honggfuzzasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

CVE-2026-35512 xrdp: Heap buffer overflow in EGFX channel

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...

matio:matio_fuzzer: Heap-buffer-overflow in H5A__read

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=4961073198333952 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzerasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow REA...

CVE-2026-32624

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domainuserseparator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain...

JLSEC-2026-136

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this...