3946 matches found
CVE-2026-65704
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...
CVE-2026-65704
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...
UBUNTU-CVE-2026-65704
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...
EUVD-2026-48371
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...
CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...
CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...
PT-2026-64155
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.3 Description An out-of-bounds write issue exists when processing a crafted ffconcat file using the -safe 0 flag. The demux audio function within the TY demuxer decrements the packet size without performing bounds...
CVE-2026-39155
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to...
CVE-2026-39155
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contain a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly, creating an overly broad authenticated denial interval. This enables downstream validating resolvers using aggressive negative caching to synthesize ...
CVE-2026-39155
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to...
CVE-2026-39155
Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to...
SUSE CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...
SUSE CVE-2026-64186
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...
GHSA-PG7V-JWJ7-P798 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Summary Pillow's EPS parser PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service. The issue is triggered...
EUVD-2026-43741
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service...
EUVD-2026-42306
node-tar: Negative tar entry size causes infinite loop in archive replace...
node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...
GHSA-8X88-C5MF-7J5W node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
PT-2026-61672
Name of the Vulnerable Software and Affected Versions DNG SDK versions 1.7.1 2536 and earlier Description A Stack-based Buffer Overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. This issue...