Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: rtw88: Fixed an alignment fault in rtwcoreenablebeacon. The rtwcoreenablebeacon function reads 4 bytes from an address that is not a multiple of 4. This results in a crash on some systems. Instead, only 1 byte is...

mingw-glib2 security update

2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...

JLSEC-2026-1134 Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files...

Issue Summary: The PKCS12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 PBMAC1 integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service...

CVE-2026-61893 MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...

CVE-2026-66349

The CVE-2026-66349 entry concerns the MMS server connection handler. A flaw in processing BER-encoded request data occurs when an MMS confirmed request PDU with an extended BER tag is received over an established session, where a missing bounds check can cause the decoder to advance its internal ...

CVE-2026-16473

The CVE-2026-16473 vulnerability affects the sbc library used by the BlueZ SBC codec. A off-by-one bug in the SBC frame decoder enables a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of a...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory. Mitigation...

CVE-2026-62349

TDengine 3.4.1.6 and earlier contains an off-by-one/write vulnerability in source/libs/parser/src/parUtil.c: trimString() only checks a single-byte space before handling SQL string escape sequences (%, _, or \x), enabling a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can le...

CVE-2026-62349

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString checks space for only one byte before processing SQL string escape sequences %, , or \x, allowing a one-byte out-of-bounds write to the...

JLSEC-2026-666 libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in...

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parseiadarray in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer...

OPENSUSE-SU-2026:21293-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...

CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

SUSE CVE-2026-58010

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

CVE-2026-58010 Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

CVE-2026-58010

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

CVE-2026-58010

GLib contains a vulnerability CVE-2026-58010: an off-by-one in gvs_tuple_is_normal() within glib/gvariant-serialiser.c triggers an out-of-bounds read of 1 byte during an alignment padding bounds check (uses > instead of >=). This can lead to a minor information disclosure of 1 byte and a de...

glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width

A flaw was found in glibc GNU C Library. This vulnerability occurs when an application uses the scanf family of functions with a %mc format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination c...

CVE-2026-10644

The Microchip SERCOM-G1 UART driver drivers/serial/uartmchpsercomg1.c, used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchronous DMA receive path. When uartrxenable is invoked with a one-byte receive buffer len == 1 and CONFIGUARTMCHPASYNC is enabled, the RX-complete...

CVE-2026-10644 Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer

The Microchip SERCOM-G1 UART driver drivers/serial/uartmchpsercomg1.c, used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchronous DMA receive path. When uartrxenable is invoked with a one-byte receive buffer len == 1 and CONFIGUARTMCHPASYNC is enabled, the RX-complete...

CVE-2026-10644

The Microchip SERCOM-G1 UART driver drivers/serial/uartmchpsercomg1.c, used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchronous DMA receive path. When uartrxenable is invoked with a one-byte receive buffer len == 1 and CONFIGUARTMCHPASYNC is enabled, the RX-complete...