CVE-2022-29072

CVE-2022-29072 7-Zip 21.07 及更早版本在 Windows 上存在权限提升和命令执行漏洞， 当具有 .7z 扩展名的文件被拖到帮助内容区域时触发。 不确定性 公众对此 CVE 存在相当大的不确定性。NIST 漏洞详情已将此 CVE 的状态标记为“等待分析”。 缓解这个“潜在”漏洞的措施是：从 7-Zip 的安装目录中移除 7-Zip 帮助文件（"7-zip.chm"）。如果我们宁可谨慎行事，最坏的情况不过是文件被移除，少数使用帮助文件的用户将无法使用，而且帮助文件会在下一次应用更新周期中重新安装。 有争议 7-Zip 21.07 及更早版本在 Windows...

ros2_CVE-2024-28231

本仓库包含一个基于 ubuntu 22 的 ros2 iron 易受攻击 Docker 镜像及对应的漏洞利用程序。我们利用 fastrtps 版本 2.10.3 中的漏洞，通过堆缓冲区溢出实现对远程订阅者的拒绝服务攻击。 易受攻击的基础镜像 Fast RTPS 2.10.3 版本及其依赖项在 Docker 容器中从 target 文件夹内的源码构建，并安装了 ros iron。 免责声明：此漏洞并非由我们发现，且已在 Fastdds 和 ros2 iron...

CVE-2026-69486

CVE-2026-69486 is a heap-based buffer overflow in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires user inte...

DEBIAN-CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-92259

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d23...

CVE-2026-92248 Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-92248 Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-92248

CVE-2026-92248 is a heap-based buffer overflow in the file-psd plugin of GIMP . When GIMP generates a thumbnail preview for a specially crafted PSD file, an integer overflow occurs during multiplication of values from an embedded JPEG header, causing an undersized heap allocation. The subsequent ...

CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

PoC-CVE-2022-26809

PoC-CVE-2022-26809 用于 CVE-2022-26809 的 PoC，分析和注意事项见 github.io。 该 PoC 是通过重写 Impacket 函数编写的。 测试环境：impacket 版本 0.10.0 该 PoC 尚未被完全测试，因为它应该触发该漏洞， 即整数溢出，导致堆上的缓冲区溢出，需要在发送 1048576 个数据包后才会触发，因为 10485764096 溢出了 32 位整数。 我没有找到任何绕过大小限制的方法，在我看来，16 位的分片长度会与真实负载大小进行核对，两者必须保持一致。 局限性： 1. 内存 -...

CVE-2026-92259

CVE-2026-92259 is an integer overflow or wraparound vulnerability in Samsung Opensource Escargot , an open-source JavaScript engine. An attacker with local write access to the bytecode-cache directory can plant a crafted cache file that triggers a heap-based buffer overflow , resulting in a denia...

CVE-2026-92259

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d23...

CVE-2014-0195

CVE-2014-0195 OpenSSL 堆溢出概念验证 CVE-2014-0195...

cve-2021-29627

CVE-2021-29627 一些用于触发该漏洞的代码，包括 macsetfd 喷射。不过，还需要一些喷射目标。...

CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

Triple_fetch

triplefetch - ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 这是针对 CVE-2017-7047 的利用程序，该漏洞是 libxpc 中的一个逻辑错误，允许恶意消息发送者发送由共享内存支持（backed）的 xpcdata 对象。xpc 消息的消费者似乎没有预料到，当接收者正在处理 xpcdata 对象时，其缓冲区的内容可能被发送者修改。 该项目利用 CVE-2017-7047 构建了一个概念验证的远程 lldb debugserver 存根（stub），能够附加到 iOS...

CVE-2023-4911

CVE-2023-4911 - Looney Tunables 这是针对 CVE-2023-4911 的一个（目前还非常粗糙的）概念验证。到目前为止，我只验证过它在 Ubuntu 22.10 kinetic 上有效。当前版本的漏洞利用包含相当多的“魔法”偏移量。如果你对如何改进堆整形有建议，欢迎向我提交 PR :。 这个漏洞利用基本上是 Qualys 的精彩分析文章 的一个实现。它在某些地方有所偏离。这不一定是因为我认为自己更懂，只是这是在我的虚拟机上可行的方法。可能还有改进的空间。 用法 1. 使用 make 编译漏洞利用程序和 suid 库。 2. 在一个可写目录中运行...

CVE-2023-28753

CVE-2023-28753 一个可能导致堆内存破坏的整数溢出漏洞。 为了演示堆破坏： 使用 ASAN 构建 ncrx 服务器 root@kitploit: make ./ncrx 31337 对抗性客户端 root@kitploit: python exploit.py -g | nc -u 127.0.0.1 31337...

CVE-2026-69218

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...