Weggli_rules_SSTIC2023

Here is a curated list of weggli queries You can read them and use them one by one, or launch them by batch: Usage: $ bash dangerousfunctions.qry code.c $ bash mallocoverflow.qry -e cc sourcedir/ There is threee categories: 1. dangerous functions: such as strcpy, system, etc.. 2. stack : tries to...

SSH-Remote-Code-Execution

SSH Remote Code Execution SSH Zero-Day | Made by ClumsyLulz & Taylor Christian Newsome Summary This repository contains a C program that accepts input parameters and generates a packet to be sent to a server over the SSH protocol. The program allocates a buffer to hold the data, writes it to a...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

CVE-2026-70638 - llama.cpp LLaMA-Android JNI Integer Overflow Companion PoC for the Hunt-Benito article "One Multiply Too Many: CVE-2026-70638 — Integer Overflow in llama.cpp's Android JNI Heap Allocation" →...

DEBIAN-CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

WebAssembly allocator shim corrupts memory on allocation failure

On wasm32, zstd-sys provides malloc and free to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. freeNULL also read below address 0. Whenever...

PT-2026-125069

On wasm32, zstd-sys provides malloc and free to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. freeNULL also read below address 0. Whenever...

Astra Linux – vulnerability in curl

A resource allocation vulnerability exists in curl versions up to and including v7.88.0; it stems from the “chained” HTTP compression algorithms. This allows a server response to be compressed multiple times, potentially using different algorithms each time. Although there is a limit on the numbe...

Astra Linux – Vulnerability in htmldoc

There is a vulnerability in htmldoc 1.9.16. In the imageloadjpeg function, when image.cxx calls malloc, ‘img-width’ and ‘img-height’ are too large to prevent an integer overflow. As a result, the malloc function may return a heap block smaller than expected, causing a buffer overflow/Address...

Astra Linux – Vulnerability in klibc

A issue was discovered in klibc before version 2.0.9. Additions in the malloc function may lead to an integer overflow, followed by a heap buffer overflow...

Astra Linux – vulnerability in ffmpeg, ffmpeg5

A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter libavfilter/affirequalizer.c due to a missing check on the return value of avmallocarray in the configinput function. An attacker could exploit this by tricking a victim into processing a crafted media file with the...

Apache ResilientDB 1.12.0 Uncontrolled Memory Allocation Denial of Service

Apache ResilientDB version 1.12.0 contains a pre-authentication uncontrolled memory allocation vulnerability in the replica TCP acceptor that allows remote denial of service via a crafted length prefix. !/usr/bin/env python Apache ResilientDB 1.12.0 Uncontrolled Memory Allocation DoS Vendor: The...

Apache ResilientDB 1.12.0 Uncontrolled Memory Allocation DoS

Summary Apache ResilientDB is a High Throughput Yielding Permissioned Blockchain Fabric founded by ExpoLab at UC Davis in 2018. ResilientDB advocates a system-centric design by implementing a multi-threaded architecture with deep pipelines. Further, ResilientDB separates the ordering of client...

CLEANSTART-2025-LU26051 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution

Security vulnerability affects the exim package. Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution...

SUSE CVE-2026-97920

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

CVE-2026-102808

PX4 Autopilot versions through 1.17.0 are vulnerable to a NULL pointer dereference within the sd_stress command. The root cause is the lack of validation for the -b byte count parameter before it is processed by malloc() and memset(). An attacker with shell access, which can be obtained via MAVLi...

CVE-2026-102808 PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

PT-2026-116249

Уязвимость функции winpr aligned malloc RDP-клиента FreeRDP связана с использованием неинициализированного ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации или вызвать отказ в обслуживании...

CVE-2026-97920

The Linux kernel contains a vulnerability where the print_entries() function incorrectly handles memory allocation failures. When a histogram stats allocation fails, the variable n_entries is overwritten with -ENOMEM. Because tracing_map_destroy_sort_entries() treats this value as an unsigned int...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-054042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054042 advisory. An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulongname, causing an...