PT-2026-26220

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=490598877 Crash type: Heap-buffer-overflow READ 1 Crash state: tinyobj::tryParseDouble tinyobj::LoadObjInternal tinyobj::LoadObj...

Unity Linux 20.1070e Security Update: xorg-x11-server (UTSA-2026-005920)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005920 advisory. A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap- buffer overflow may lead to a privilege escalation vulnerabilit...

ALSA-2026:3967 Important: libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fixes: libvpx: Heap buffer overflow in libvpx CVE-2026-2447 For more details about the security issues, including the...

pyvex:irsb_fuzzer: Heap-buffer-overflow in libpyvex.so

Detailed Report: https://oss-fuzz.com/testcase?key=4798045517840384 Project: pyvex Fuzzing Engine: libFuzzer Fuzz Target: irsbfuzzer Job Type: libfuzzerasanpyvex Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6160006566c9 Crash State: libpyvex.so disInstrARM bbtoIR...

libvips:vips_fuzzer: Heap-buffer-overflow in vips_sign_buffer

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=6674538674061312 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

tinyobjloader:fuzz_ParseFromString: Heap-buffer-overflow in tinyobj::tryParseDouble

Project: https://github.com/tinyobjloader/tinyobjloader.git Detailed Report: https://oss-fuzz.com/testcase?key=5352302256128000 Project: tinyobjloader Fuzzing Engine: libFuzzer Fuzz Target: fuzzParseFromString Job Type: libfuzzerasantinyobjloader Platform Id: linux Crash Type: Heap-buffer-overflo...

ffmpeg:ffmpeg_AV_CODEC_ID_VVC_fuzzer: Heap-buffer-overflow in cbs_h266_read_pps

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4711353817563136 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDVVCfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer: Heap-buffer-overflow in write_lcevc_nalu

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4605696279904256 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFEXTRACTEXTRADATAfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

vlc:vlc-demux-dec-libfuzzer-mp4: Heap-buffer-overflow in dav1d_decode_tile_sbrow

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6070174037114880 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-mp4 Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address: 0x74bd82a7e780...

PT-2026-46311

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=489911024 Crash type: Heap-buffer-overflow WRITE 3 Crash state: cupsRasterAddError cupsRasterExecPS fuzz cups.c...

Fedora 44 : perl-Crypt-URandom (2026-eb6b1039eb)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eb6b1039eb advisory. This release fixes CVE-2026-2474 a heap buffer overflow and handling failed read syscalls. Tenable has extracted the preceding description block directly fro...

(Pwn2Own) Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process. The specific flaw exists within the handling of...

SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2026:0763-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0763-1 advisory. - CVE-2026-24491: heap-use-after-free in videotimer bsc1257981. - CVE-2026-24675: heap-use-after-free in...

Oracle Linux 10 : postgresql16 (ELSA-2026-3887)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-3887 advisory. - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow - Fix...

RockyLinux 10 : libpng (RLSA-2026:3551)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3551 advisory. libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API CVE-2026-22801 libpng: libpng: Denial of...

RHEL 10 : postgresql16 (RHSA-2026:3887)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3887 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that...

RHEL 9 : postgresql:15 (RHSA-2026:3896)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3896 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL missing validation of...

vlc:vlc-demux-dec-libfuzzer-ts: Heap-buffer-overflow in PESDataChainHandle

Detailed Report: https://oss-fuzz.com/testcase?key=5718058584047616 Project: vlc Fuzzing Engine: honggfuzz Fuzz Target: vlc-demux-dec-libfuzzer-ts Job Type: honggfuzzasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x7b3616536f03 Crash State: PESDataChainHandle...

cups:fuzz_cups: Heap-buffer-overflow in _cupsRasterAddError

Project: https://github.com/OpenPrinting/cups.git Detailed Report: https://oss-fuzz.com/testcase?key=4517534425743360 Project: cups Fuzzing Engine: libFuzzer Fuzz Target: fuzzcups Job Type: libfuzzerasancups Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 3 Crash Address: 0x7a86bd3e04a2...

MiracleLinux 9 : libpng-1.6.37-12.el9_7.2 (AXSA:2026-246:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-246:05 advisory. libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API CVE-2026-22801 libpng: libpng: Denial of...