EulerOS 2.0 SP15 : perl (EulerOS-SA-2026-3813)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.x000D x00...

RHEL 9 : libvirt (RHSA-2026:68511)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68511 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In...

MiracleLinux 9 : openssl-3.5.8-1.el9_8.ML.1 (AXSA:2026-1865:17)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1865:17 advisory. openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUIC server may trigger double free when...

CVE-2019-18634-writeup

CVE-2019-18634（https://www.exploit-db.com/exploits/47995）分析 Sudo 1.8.25p - 'pwfeedback' 缓冲区溢出（PoC） Sudo 的 pwfeedback 选项可用于在用户输入密码时提供视觉反馈。每次按键时，都会打印一个星号。该选项是为了回应用户对标准 Password: 提示符禁用按键回显的困惑而添加的。虽然上游版本的 sudo 默认未启用 pwfeedback，但某些系统（如 Linux Mint 和 Elementary OS）会在其默认的 sudoers 文件中启用该选项。 分析 Sudo 缓冲区溢出...

RLSA-2026:67848 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

OPENSUSE-SU-2026:21867-1 Security update for mkvtoolnix

This update for mkvtoolnix fixes the following issues: Changes in mkvtoolnix: - CVE-2026-90783: heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic boo1280126...

CVE-2026-92399 GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow

A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handler. Executing a manipulation of the argument payloadsize can lead to heap-based buffer overflow. It is possible to launch the attack...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-10575)

Summary IBM MQ has addressed an heap buffer overflow vulnerability when processing MQPUT operations with malformed distribution headers that could allow a remote authenticated attacker to cause a denial of service or potentially escalate privileges. Vulnerability Details CVEID:CVE-2026-10575...

cve-2019-6250-lab

CVE-2019-6250 — libzmq pre-auth RCE lab End-to-end working RCE chain + reproducible lab for CVE-2019-6250 , the pre-auth heap-buffer-overflow in libzmq's v2decodert::sizeready. A uint64t pointer-arithmetic overflow lets an unauthenticated peer overwrite the adjacent msgt::contentt::ffn function...

MGASA-2026-0410 Updated aom packages fix security vulnerabilities

Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. CVE-2026-56208 Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. CVE-2026-56209 Heap-buffer-overflow read via missing bounds check in ctrlsetlayerid. CVE-2026-56210 Remote code executi...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

Security Bulletin: IBM MQ Appliance is affected by a heap-based buffer overflow vulnerability (CVE-2026-10575)

Summary IBM MQ Appliance has addressed a heap-based buffer overflow vulnerability. Vulnerability Details CVEID:CVE-2026-10575 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQP...

CVE-2023-6931

CVE-2023-6931 Kernel Panic PoC for CVE-2023-6931 Description CVE-2023-6931 is a vulnerability in perfevent that leads to a heap buffer overflow caused by an integer overflow in the readsize of a group. What is a Performance Event perf event? perfevents is a performance monitoring and analysis...

coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values

A flaw was found in GNU coreutils, specifically in the unexpand utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when unexpand processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing...

corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

A heap-based buffer overflow was found in Corosync's Totem Process Group totempg message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast...

CVE-2023-40294-and-CVE-2023-40295

While I was running boron in my environment, I happened to stumble upon 2 heap buffer overflows in libboron libboron.so.2 version 2.0.8 when processing slightly malformed input. This has been officially tested on both Mac x8664 and Linux x8664: Files for reproduction reproduction.zip Compiling...

CVE-2022-44318

Description of CVE-2022-44318 PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall. Any project or library that uses Picoc also suffers from this issue. An example of this would be...

nginx-rift-check

nginx-rift-check 发现存在 CVE-2026-42945 漏洞的配置，该漏洞是 nginx 的 ngxhttprewritemodule 中的堆缓冲区溢出。 仅运行受影响的 nginx 版本（0.6.27 到 1.30.0）并不足以被利用。配置必须包含一对特定的指令，而这对指令很罕见：两次对真实世界配置的独立扫描分别在 1465 个配置中发现 0 个可利用配置、在 35633 个中发现 1 个。本脚本会告诉你，你处于这条线的哪一侧。 它查找什么 一个 rewrite，其替换内容包含一个? 且后面带有参数，随后在同一个 location 中读取一个未命名捕获组 （$1 到...

CVE-2026-81634

A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could le...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...