CVE-2026-90556

A flaw was found in Freeciv. This vulnerability, a heap buffer overflow in the worklistload function, occurs when processing specially crafted savegame files. An attacker can create a malicious savegame file that, when loaded by a user or server operator, causes memory corruption. This could lead...

CVE-2026-89266

A flaw was found in stbvorbis, an open-source library for Ogg Vorbis decoding. This vulnerability, a heap buffer overflow, occurs in the startdecoder function due to an integer truncation error when allocating memory for codebook multiplicands. A remote attacker could exploit this by crafting a...

CVE-2026-90783

A flaw was found in MKVToolNix. An attacker can exploit this vulnerability by crafting a malicious AVI Audio Video Interleave file. When the mkvmerge tool processes this file, an integer wraparound in the bundled avilib library's ODML OpenDML superindex parser leads to an undersized memory...

Important: Red Hat Security Advisory: openssl security, bug fix, and enhancement update

An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

openssl: heap buffer overflow in CMS key unwrapping

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie directives. This could lead to a denial of service DoS condition, making the server unavailable to legitimate users...

EUVD-2026-77198

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

CVE-2026-90682 Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

CVE-2025-64031

A flaw was found in libarchive, a data archiving library. This vulnerability, a heap-based buffer overflow in the gzip writer, occurs when handling the original-filename field. While exploitation requires a specific, marginally plausible scenario where an untrusted source provides the filename, a...

PT-2026-91045

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG GPS LAT/TAG GPS LONG leads to heap-based buffer overflow. An attack has to be...

RHEL 10 : openssl (RHSA-2026:67154)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67154 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Medium: libreoffice

Issue Overview: LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a...

PT-2026-91215

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2026-3912)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3912 advisory. GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allo...

AlmaLinux 10 : 389-ds-base (ALSA-2026:64785)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64785 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...

TencentOS Server 4: gstreamer1-plugins-good (TSSA-2026:0997)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0997 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary cod...

Amazon Linux 2 : rsyslog (ALAS-2026-3904)

The version of rsyslog installed on the remote host is prior to 8.24.0-57. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3904 advisory. A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace...