6201 matches found
CVE-2026-70652
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...
CVE-2026-70652
libvips versions before 8.18.3 mis-size an output buffer in vips_foreign_save_uhdr_set_raw_hdr (libvips/foreign/uhdrsave.c) when a pipeline enlarges a JPEG before encoding a gain map, causing a heap buffer over-read that can leak adjacent data or crash the process. Upgrade to 8.18.3 to remediate....
CVE-2026-70652 libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...
elFinder <= 2.1.47 - Command Injection
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection. id: CVE-2019-9194 info: name:...
openjdk: Enhance JPEG handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. ASAN reports a heap integrity violation...
openjdk: Enhance JPEG handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. ASAN reports a heap integrity violation...
openjdk: Enhance JPEG handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. ASAN reports a heap integrity violation...
Astra Linux – Vulnerability in GraphicsMagick
The ReadJXLImage function in the JXL library within GraphicsMagick before version 1.3.46 has no image dimension resource limits...
Astra Linux – Vulnerability in gdk-pixbuf
A flaw was discovered in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for...
Astra Linux – Vulnerability in imagemagick
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a continue statement in the JPEG extent binary search loop in the jpeg encoder caused an infinite loop when writing persistent errors. An attacker could trigger...
Astra Linux – Vulnerability in gst-plugins-bad1.0
GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may va...
CVE-2026-17264
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...
MiracleLinux 9 : gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1 (AXSA:2026-1479:03)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1479:03 advisory. gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit confusion CVE-2026-52718 gstreamer1-plugins-bad-free:...
CVE-2026-17264 Medixant RadiAnt DICOM Out-of-bounds write
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...
CVE-2026-17264
CVE-2026-17264 describes a heap-based out-of-bounds write in the RadiAnt DICOM viewer (Medixant) triggered by opening a crafted DICOM file containing malicious JPEG-compressed pixel data, potentially enabling remote code execution. Public documents confirm the impact as attacker-controlled memory...
CVE-2026-17264
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code...
MiracleLinux 8 : java-21-openjdk-21.0.12.0.8-1.1.el8.ML.1 (AXSA:2026-1475:08)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1475:08 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...
AlmaLinux 10 : java-25-openjdk (ALSA-2026:42899)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42899 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance...
gstreamer1 -- multiple vulnerabilities
The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...