CVE-2026-112052

A flaw was found in libspatialite. An integer overflow in the Well-Known Binary WKB geometry parsing routines can lead to a Denial of Service DoS or memory corruption. By providing a specially crafted database file or geometry object with an excessively large point count, an attacker can trigger...

CVE-2026-112048

A flaw was found in libspatialite. The library fails to validate the polygon ring count when parsing geometry data in the Well-Known Binary WKB format. An attacker can exploit this issue by supplying specially crafted geometry input to trigger uncontrolled memory allocation, leading to a Denial o...

EUVD-2026-103521

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059

Versions of libLAS through 1.8.1 are vulnerable to a heap out-of-bounds write in the point record reader. The root cause is the truncation of the schema byte size to 16 bits when sizing the point buffer. An attacker can exploit this by crafting a .las file containing a LASSchema variable length r...

CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112048 libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count

libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or STGeomFromWKB input to crash the process or...

CVE-2026-112048

Versions of libspatialite through 5.1.0 are vulnerable to uncontrolled memory allocation due to a failure to validate the polygon ring count in the ParseWkbPolygon function. An attacker can provide crafted geometry BLOBs—either within a SpatiaLite database or via ST_GeomFromWKB input—to trigger e...

CVE-2026-112048 libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count

libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or STGeomFromWKB input to crash the process or...

CVE-2026-112020

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepngutil.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

CVE-2026-112012

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-112020

The LodePNG library (versions through 20261006 ) is vulnerable to a heap out-of-bounds read in the lodepng::getFilterTypesInterlaced() function located in lodepng_util.cpp. The root cause is a lack of bounds checks on decompressed IDAT data . An attacker can exploit this by providing a crafted in...

CVE-2026-112020 LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepngutil.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

EUVD-2026-103473

LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced in lodepngutil.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent...

CVE-2026-112012

The libtta library (versions through 2.3 ) contains a stack out-of-bounds read and write vulnerability within the tta_decoder_process_stream() and tta_decoder_process_frame() functions. The root cause is that header checks fail to reject a zero channel count . An attacker can provide a specially ...

CVE-2026-112012 libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

EUVD-2026-103465

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2012-6422

Exynos Exploit This is a POC for exploiting the /dev/exynos-mem vulnerability introduced in earlier samsung phones. It was done out of interest in kernel vulnerability research and as a part of a CTF challenge. The Exploit The vulnerability introduced in these phones is the permissions for the...

CVE-2026-98451: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...