CVE-2026-10681

The CVE-2026-10681 issue affects Zephyr's userspace dynamic-objects subsystem. In thread_idx_alloc(), a new thread permission index is taken from _thread_idx_map[] without holding lists_lock. On SMP, concurrent k_object_alloc(K_OBJ_THREAD) calls can observe the same lowest free bit and perform a ...

CVE-2026-64173

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...

EUVD-2024-53214

Malicious code in bioql PyPI...

CVE-2022-40761

The function teeobjfree in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service DoS by invoking the function TEEAllocateOperation with a disturbed heap layout, related to uteecrypobjalloc...

CVE-2024-26900

A memory leak flaw was found in rdev-serial in the Linux kernel. This issue may lead to a crash...

Denial Of Service (DoS)

encodedid-rails is vulnerable to Denial of service attack. The vulnerability is due to a lack of validation while decoding hashid. Extremely long encoded id's consumes a large amount of CPU and allocates immediate objects. maxlength parameter is introduced to fix this vulnerability which limits t...

CVE-2022-40761

The function teeobjfree in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service DoS by invoking the function TEEAllocateOperation with a disturbed heap layout, related to uteecrypobjalloc...

PT-2022-25522 · Samsung · Samsung Mtower

Name of the Vulnerable Software and Affected Versions: Samsung mTower versions 0.3.0 and earlier Description: The issue allows a trusted application to trigger a Denial of Service DoS by invoking the function TEE AllocateOperation with a disturbed heap layout, related to utee cryp obj alloc. This...

Foxit PDF Reader 缓冲区错误漏洞

Foxit PDF Reader is China Foxit Foxit company a PDF reader. Foxit PDF Reader suffers from a buffer overflow vulnerability that originates from the application failing to properly validate the allocation boundaries of an object when handling certain JavaScript, which can be exploited by an attacke...

CVE-2018-6065

Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2018-6065

Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Google Chrome V8 - Object Allocation Size Integer Overflow

Google Chrome V8 - Object Allocation Size Integer Overflow There's an integer overflow in computing the required allocation size when instantiating a new javascript object. See the following code in objects.cc // static bool JSFunction::CalculateInstanceSizeForDerivedClass Handle function,...

Google Chrome V8 - Object Allocation Size Integer Overflow Exploit

Exploit for multiple platform in category dos / poc There's an integer overflow in computing the required allocation size when instantiating a new javascript object. See the following code in objects.cc // static bool JSFunction::CalculateInstanceSizeForDerivedClass Handle function, InstanceType...

Google Chrome V8 - Object Allocation Size Integer Overflow

There's an integer overflow in computing the required allocation size when instantiating a new javascript object. See the following code in objects.cc // static bool JSFunction::CalculateInstanceSizeForDerivedClass Handle function, InstanceType instancetype, int requestedembedderfields, int...

Design/Logic Flaw

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that 1 was not properly allocated or 2 is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild...