PT-2026-22420

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0077 Description Vim is an open-source, command-line text editor. Versions prior to 9.2.0077 contain a heap-buffer-overflow and a segmentation fault SEGV within the swap file recovery logic. These issues are triggered...

RLSA-2026:3334 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: freerdp: FreeRDP heap-buffer-overflow CVE-2026-22855 freerdp: FreeRDP...

OPENSUSE-SU-2026:20273-1 Security update for 7zip

This update for 7zip fixes the following issues: - Update to 25.01 boo1249130 The code for handling symbolic links has been changed to provide greater security when extracting files from archives Command line switch -snld20 can be used to bypass default security checks when creating symbolic link...

assimp:assimp_fuzzer: Heap-buffer-overflow in Assimp::MDLImporter::SkipSkinLump_3DGS_MDL7

Detailed Report: https://oss-fuzz.com/testcase?key=4734098021351424 Project: assimp Fuzzing Engine: honggfuzz Fuzz Target: assimpfuzzer Job Type: honggfuzzasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x512000000bcb Crash State:...

ffmpeg:ffmpeg_AV_CODEC_ID_MAGICYUV_DEC_fuzzer: Heap-buffer-overflow in magy_decode_slice

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4683933221715968 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDMAGICYUVDECfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type:...

Important: Red Hat Security Advisory: libpng security update

An update for libpng is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

AlmaLinux 9 : libpng15 (ALSA-2026:3031)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:3031 advisory. libpng: LIBPNG has a heap buffer overflow in pngsetquantize CVE-2026-25646 Tenable has extracted the preceding description block directly from the AlmaLinux securi...

Important: libpng security update

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics PNG image format files. Security Fixes: libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API CVE-2026-22801 libpng: libpng: Denial of...

CVE-2026-27692

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release when strlen reads past a heap buffer while parsing ICC profile XML text description tags,...

OSV-2026-308 Heap-buffer-overflow in vcardstructured_new_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486715154 Crash type: Heap-buffer-overflow WRITE 8 Crash state: vcardstructurednewfromstring vcardparametersetvaluefromstring parsevcard...

CVE-2026-27692: Out-of-bounds Read

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release when strlen reads past a heap buffer while parsing ICC profile XML text description tags,...

PT-2026-23808

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486715154 Crash type: Heap-buffer-overflow WRITE 8 Crash state: vcardstructured new from string vcardparameter set value from string parse vcard...

PT-2026-23901

OpenPixelCache updates image channel metadata before attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls GetPixelIndex...

iccDEV 缓冲区错误漏洞

iccDEV is an open-source color configuration code library developed by the International Color Consortium. Versions of iccDEV prior to 2.3.1.4 contained a buffer error vulnerability. This vulnerability occurred during the parsing of XML text description tags for the CIccTagTextDescription::Releas...

PT-2026-21916

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.5 Description iccDEV is a set of libraries and tools for working with ICC color management profiles. A heap-buffer-overflow read occurs during CIccTagTextDescription::Release when strlen reads past a heap buffer...

CVE-2026-26955: Out-of-bounds Write

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline e.g., xfreerdp by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

RLSA-2026:3031 Important: libpng15 security update

The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG Portable Network Graphics image format files. This version should be used only if you are unable to use the current version of libpng. Security Fixes: libpng: LIBPNG has a heap buffer overflow i...

GHSA-VHQJ-F5CJ-9X8H ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions

WriteUHDRImage in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of...

389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow

A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schemaattrenumcallback function within the schema.c file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting...