SUSE-SU-2026:23172-1 Security update for openssl-3

This update for openssl-3 fixes the following issue - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712...

Memory Allocation with Excessive Size Value

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the parsing of the /ToUnicode entry of a font with unusually large values. An...

JLSEC-2026-1183 FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

SUSE-SU-2026:23058-1 Security update for openssl-3

This update for openssl-3 fixes the following issue: - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712...

Exploit for CVE-2026-70638

CVE-2026-70638 - llama.cpp LLaMA-Android JNI Integer Overflow...

UBUNTU-CVE-2026-18938

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

...

PT-2026-69434

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A signed integer overflow occurs in the file-fli plugin when processing FLI image files. The issue stems from an incorrect calculation during memory allocation for image buffers, where multiplyi...

PT-2026-76900

This update for openssl-3-livepatches fixes the following issues: - 'HollowByte' DoS via attacker-controlled memory allocation bsc1271712, bsc1271713...

PT-2026-76898

This update for openssl-1 1-livepatches fixes the following issues: - 'HollowByte' DoS via attacker-controlled memory allocation bsc1271712, bsc1271713...

PT-2026-76899

This update for openssl-1 1-livepatches fixes the following issues: - 'HollowByte' DoS via attacker-controlled memory allocation bsc1271712, bsc1271713...

DEBIAN-CVE-2026-70638

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

CVE-2026-43627

The CVE-2026-43627 issue affects llama.cpp (b1283–b9058) in the llama_batch_init() function, where unchecked multiplications in malloc() cause allocation sizes to wrap past INT32_MAX. This leads to heap corruption and can potentially enable arbitrary code execution through subsequent batch operat...

CVE-2026-43627 llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...

CVE-2026-43627 llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...

CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-66733

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The...

CVE-2026-66733

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The...

CVE-2026-66733 Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The...

CVE-2026-66733

Sonic 3 A.I.R. is affected by an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() prior to commit 2492d18. The mUniquePacketID field is read directly from the UDP wire-format header without bounds checking, causing the server to allocate one CacheItem per missing ...