CVE-2026-77214

The libexpat library (versions prior to commit 13c5f63 ) contains a heap buffer over-read vulnerability in xmlparse.c. The XML_ParseBuffer function fails to validate the caller-supplied len against the allocated buffer size when updating parser->m_bufferEnd. Consecutive calls to XML_ParseBuffe...

CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

CVE-2026-106061 Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

A flaw was found in GIMP’s X cursor XMC thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subseque...

CVE-2026-106061

A flaw in GIMP 's X cursor (XMC) thumbnail loader allows for a heap buffer over-read . The issue occurs because the software uses 32-bit signed arithmetic to calculate the pixel buffer size (width * height) for thumbnails. An integer overflow (CWE-190) in this calculation can result in an undersi...

PT-2026-107540

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.9.0 Description A heap buffer over-read exists in the xmlparse.c file. The XML ParseBuffer function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer...

CVE-2026-77214: Out-of-bounds Read

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

CVE-2026-19029

HDF5 versions through 2.2.0 are vulnerable to a heap-based buffer over-read within the H5Z__filter_scaleoffset() function located in src/H5Zscaleoffset.c. The root cause occurs when the decoder copies d_nelmts * size bytes from a compressed chunk without verifying if the chunk contains sufficient...

CVE-2026-19029 HDF5 scale-offset filter heap buffer over-read via crafted chunk

A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes...

CVE-2026-19029

A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes...

CVE-2026-19029 HDF5 scale-offset filter heap buffer over-read via crafted chunk

A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes...

openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.

A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_59490)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659490 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service i...

Rocky Linux 10.2 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_59220)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659220 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of servic...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_59362)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659362 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service i...

CentOS Linux 7 [TuxCare] Security Update: libpng / libpng-devel / libpng-static (CENTOS7:CLSA-2025:1766165929)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1766165929 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2025_15687)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202515687 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decod...

AlmaLinux 9.2 [TuxCare] Security Update: libpng15 (ALMALINUX9.2:CLSA-2026:1785495654)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785495654 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_4263)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254263 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decode...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2025_8132)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258132 advisory. libsoup: Heap buffer over-read in skipinsignificantspace when sniffing content CVE-2025-2784 libsoup: Denial of Service attack to websocket server...