freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD local privilege escalation viaexecargsadjustargs OOB memmove An operator-precedence bug in execargsadjustargs sys/kern/kernexec.c, present since 2013 lets any local user escalate to root on a...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – libtiff TIFFReadRGBATileExt Analysis Overview This lab analyzes CVE-2023-52356 in libtiff, focusing on the behavior of TIFFReadRGBATileExt when it receives image coordinates outside the valid image bounds. The analysis includes reproduction of the original crash, debugging with...

CVE-2021-21551

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vulnerability comes from user provided addresses being provided as arguments to a memmove call allowing for an arbitary read/write ioctls 0x9B0C1EC4 and 0x9B0C1EC8 as well as the physical address parameter for a MmMapIoSpace call that...

cve-2024-46483

CVE-2024-46483 - Pre-Authentication Heap Overflow in Xlight SFTP server Affected versions Xlight 32 and 64-bit versions = 3.9.4.2 Impact An unauthenticated attacker with access to Xlight SFTP could gain code execution or cause a denial or service. Root Cause Strings sent across the wire in the SF...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

CVE-2024-26160

CVE-2024-26160 cldflt.sys information disclosure vulnerability There's small writeup about CVE-2024-26160 , what can be found in the February patch KB5034765 , Windows 11 22H2, Windows 11 23H2. The vulnerability has been closed in the March patch KB5035853. Analysis The vulnerability is located i...

CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: Source-buffer under-allocation in CopyPixels path leads to out-of-bounds read and Access Violation DoS When decoding a crafted HEIF image through WIC, the msheif codec allocates a 1-byte source buffer but later attempts to copy a very large amount ...

CVE-2026-99107 ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

CVE-2026-99107 ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

PT-2026-128100

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs attr record resize ntfs new attr flags passes the wrong MFT record to ntfs attr record resize. When the attribute is in an extent record, ctx-mrec points to the extent but the...

Linux Distros Unpatched Vulnerability : CVE-2026-99107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute i...

CLSA-2026-1792171196 lz4: Fix of CVE-2021-3520

CVE-2021-3520: Fix potential memory corruption with negative memmove size...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: kobjectuevent: Fixed issues related to OOB access within zapmodaliasenv. The zapmodaliasenv function incorrectly calculates the size of the memory block to be moved. This can lead to OOB out-of-band memory access issues if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “vt: fix unicode buffer corruption when deleting characters” This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 “vt: fix memory overlapping when deleting chars in the buffer”. The solution is als...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can cause an integer overflow in the memmove function, resulting in a heap-based buffer overflow in the ntfsattrrecordresize function, as of NTFS-3G version 2021.8.22...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: The code checks rlused against rlcount in the refcount block validator. The ocfs2findrefcountrecinrl function iterates through the refcount record array stored on disk as follows: c for ; i rfrecords.rlused; i++ rec =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges the routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not greater than the number of addresses described...

Astra Linux – vulnerability in linux-6.1, linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105tabledeleteentry There are actually 2 problems: - Deleting the last element does not require the memmove of elements i + 1, end over it. In fact, element i+1 is out of...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the UpdateRecordDataRoot,Allocation functions in fs/ntfs3, the destination of the memmove operation is Add2Ptre, le16tocpue-view.dataoff. Here, e-view.dataoff comes from an NTFSDE stored on disk, within an INDEXROOT or...

Security Bulletin: IBM i is Affected by a Heap Buffer Overflow Vulnerability in Zlib [CVE-2026-85091]

Summary IBM i is vulnerable to a heap buffer overflow vulnerability due to an unchecked memmove in Zlib CVE-2026-85091 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-85091 DESCRIPTION: zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow...