CVE-2026-64532

Summary: CVE-2026-64532 affects the Linux kernel ntfs3 path. Filesystem code in UpdateRecordDataRoot/UpdateRecordDataAllocation bound checks for on-disk NTFS_DE view.data_off are missing when memmoving data, allowing potential out-of-bounds writes. The issue arises because memmove destinations us...

CVE-2026-64533: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fro...

Linux Distros Unpatched Vulnerability : CVE-2026-64533

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart...

EUVD-2026-48905

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

CVE-2026-64361

CVE-2026-64361 affects the Linux kernel’s hfs/hfsplus code. The vulnerability arises in check_and_correct_requested_length, where a comparison uses 32‑bit arithmetic (off + len) against node_size. If a large len is supplied (e.g., due to underflow in hfs_brec_remove), off + len may wrap around 2^...

CVE-2026-64361: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

PT-2026-85722

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the AH6 component of the xfrm subsystem. The ipv6 rearrange rthdr function assumes that the segments left value is not larger than the number of...

[FreeBSD] ptrace PT_SC_REMOTE missing argument validation: 32GiB memmove underflow + sysent out-of-bounds call

Summary A local unprivileged user can trigger a 32GiB memmove underflow via ptrace PTSCREMOTE with pscrnargs=0, and call arbitrary sysent function pointers due to missing syscall number bounds check in ptracesyscallreq. This allows kernel code execution under security.bsd.unprivilegedprocdebug=1...

CVE-2025-62821

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntryGetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copysize = stride absroiheight but does not check the...

CVE-2025-62821

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntryGetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copysize = stride absroiheight but does not check the...

PT-2026-50877

Name of the Vulnerable Software and Affected Versions Microsoft HEIF Image Extensions version 1.2.22.0 Description An out-of-bounds read occurs because the CHEIFItemInfoEntry GetDataSize function can return a success status while leaving the reported data size at 0. This leads a caller to perform...

CVE-2025-62821: Undefined Security Weakness

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntryGetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copysize = stride absroiheight but does not check the...

CVE-2025-62821

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntryGetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copysize = stride absroiheight but does not check the...

CVE-2025-62821

Microsoft HEIF Image Extensions (version 1.2.22.0) contains an out-of-bounds read vulnerability within the msheif_store.dll module. The root cause is that CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size at 0, leading a caller to allocate only a 1-byte source...

CVE-2026-54412 MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqttunpackpublishresponse function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to...

lldpd: Heap OOB Read in VLAN Decapsulation memmove

...

AZL-89700 CVE-2026-46433 affecting package lldpd for versions less than 1.0.22-1

lldpd is an implementation of IEEE 802.1ab LLDP. Prior to version 1.0.22, lldpddecode in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove to shift the frame payload 4 bytes left. The third argument byte count is s - 2 ETHERADDRLEN but should be s - 2...

UBUNTU-CVE-2026-46433

lldpd is an implementation of IEEE 802.1ab LLDP. Prior to version 1.0.22, lldpddecode in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove to shift the frame payload 4 bytes left. The third argument byte count is s - 2 ETHERADDRLEN but should be s - 2...

CVE-2026-46433

lldpd is an implementation of IEEE 802.1ab LLDP. Prior to version 1.0.22, lldpddecode in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove to shift the frame payload 4 bytes left. The third argument byte count is s - 2 ETHERADDRLEN but should be s - 2...

CVE-2026-46433

lldpd is an implementation of IEEE 802.1ab LLDP. Prior to version 1.0.22, lldpddecode in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove to shift the frame payload 4 bytes left. The third argument byte count is s - 2 ETHERADDRLEN but should be s - 2...