CVE-2026-80741

CVE-2026-80741 is an out-of-bounds read in the Linux kernel's DRM logging subsystem (drm/log). The function drm_log_draw_kmsg_record() accesses s[len - 1] to strip a trailing newline, but since len is an unsigned int , a value of zero causes the subtraction to wrap to UINT_MAX, reading far beyond...

CVE-2026-80741: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3882 (ALAS-2026-3882)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3882 advisory. Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing a...

CVE-2026-59983 OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when...

EUVD-2026-64138

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signe...

CVE-2026-75147

FFmpeg versions before commit 983dae9 have an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). A crafted OBU size causes the remaining-size counter to wrap, letting the keyframe-detection loop dereference a pointer past the packet buffer. CVSS 3.1 scores 7.1 (HIGH). No in-...

PT-2026-78530

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 983dae9 Description An out-of-bounds read exists in the AV1 RTP packetizer within the libavformat/rtpenc av1.c file. The issue occurs during the keyframe detection loop when searching for a sequence header OBU...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

PT-2026-69596

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wilc1000 wifi driver where the wilc parse assoc resp info function fails to validate the length of a received association response before subtracting the header...

PT-2026-81461

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description On ILP32 builds, an out-of-bounds read occurs when processing a crafted uncompressed deep-tile EXR. This happens because t...

CVE-2026-64267: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

CVE-2026-63893 thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...

Important: postgresql17

Issue Overview: Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions...

AZL-89013 CVE-2026-46195 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parsesecdesc, buildsecdesc, and the chown path in idmodetocifsacl all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returne...

PT-2026-35476

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector total sizes for attacker-controlled large counts across many parts, tot...

libcoap 安全漏洞

Libcoap is a lightweight application protocol implementation developed by ObgM. Libcoap has a security vulnerability, which stems from out-of-bounds read operations during the CBOR decapsulation processing in OSCORE Appendix B.2. This vulnerability may lead to a heap buffer overflow attack throug...

CVE-2026-27622

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector totalsizes for attacker-controlled large counts across many parts,...

CVE-2021-27427

RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...

CVE-2021-27425

Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mmmalloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution...