CVE-2021-21551

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vulnerability comes from user provided addresses being provided as arguments to a memmove call allowing for an arbitary read/write ioctls 0x9B0C1EC4 and 0x9B0C1EC8 as well as the physical address parameter for a MmMapIoSpace call that...

cve-2024-46483

CVE-2024-46483 - Pre-Authentication Heap Overflow in Xlight SFTP server Affected versions Xlight 32 and 64-bit versions = 3.9.4.2 Impact An unauthenticated attacker with access to Xlight SFTP could gain code execution or cause a denial or service. Root Cause Strings sent across the wire in the SF...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD local privilege escalation viaexecargsadjustargs OOB memmove An operator-precedence bug in execargsadjustargs sys/kern/kernexec.c, present since 2013 lets any local user escalate to root on a...

CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: Source-buffer under-allocation in CopyPixels path leads to out-of-bounds read and Access Violation DoS When decoding a crafted HEIF image through WIC, the msheif codec allocates a 1-byte source buffer but later attempts to copy a very large amount ...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – libtiff TIFFReadRGBATileExt Analysis Overview This lab analyzes CVE-2023-52356 in libtiff, focusing on the behavior of TIFFReadRGBATileExt when it receives image coordinates outside the valid image bounds. The analysis includes reproduction of the original crash, debugging with...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

CVE-2024-26160

CVE-2024-26160 cldflt.sys information disclosure vulnerability There's small writeup about CVE-2024-26160 , what can be found in the February patch KB5034765 , Windows 11 22H2, Windows 11 23H2. The vulnerability has been closed in the March patch KB5035853. Analysis The vulnerability is located i...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can cause an integer overflow in the memmove function, resulting in a heap-based buffer overflow in the ntfsattrrecordresize function, as of NTFS-3G version 2021.8.22...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: kobjectuevent: Fixed issues related to OOB access within zapmodaliasenv. The zapmodaliasenv function incorrectly calculates the size of the memory block to be moved. This can lead to OOB out-of-band memory access issues if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “vt: fix unicode buffer corruption when deleting characters” This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 “vt: fix memory overlapping when deleting chars in the buffer”. The solution is als...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the UpdateRecordDataRoot,Allocation functions in fs/ntfs3, the destination of the memmove operation is Add2Ptre, le16tocpue-view.dataoff. Here, e-view.dataoff comes from an NTFSDE stored on disk, within an INDEXROOT or...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: The code checks rlused against rlcount in the refcount block validator. The ocfs2findrefcountrecinrl function iterates through the refcount record array stored on disk as follows: c for ; i rfrecords.rlused; i++ rec =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges the routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not greater than the number of addresses described...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fixed the “kasan out-of-bounds” warning in sja1105tabledeleteentry. There are actually two issues: 1. Deleting the last element does not require moving elements. In fact, element i+1 is out of bounds. 2. The...

Rocky Linux 8 [CIQ] Security Update: lz4 / lz4-debuginfo / lz4-debugsource / lz4-devel / lz4-libs / etc (crlsa-2021_2575)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212575 advisory. lz4: memory corruption due to an integer overflow bug caused by memmove argument CVE-2021-3520 Tenable has extracted the preceding description block directly from t...

ANT-2026-QT406EDT · LibreOffice/core · Memory corruption (heap buffer overflow)

other medium CVE-2026-63274 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-QT406EDT: Heap overflow from unclamped /Length...

SUSE CVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

CVE-2026-19499

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...