thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

Microsoft Office Word Information Disclosure Vulnerability

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

JLSEC-2026-1243 A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in...

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information...

JLSEC-2026-1247 A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list...

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundar...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

PT-2026-70705

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An off-by-one error occurs when a program writes or reads one element past the end of an array, which can lead to memory corruption or information disclosure. In this case, the...

CVE-2026-72689

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-68272

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

EUVD-2026-55618

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CVE-2026-68402

Summary: CVE-2026-68402 affects the Linux kernel Wi‑Fi stack (cfg80211). A flaw in cfg80211_is_element_inherited() may read the first byte of an extension element (elem->data[0]) without confirming the element has data, allowing a crafted Wi‑Fi frame to trigger a one‑octet slab‑out‑of‑bounds r...

CVE-2026-68338

CVE-2026-68338 affects Linux kernel net/packet: a race during fanout hook re-registration after a device unregistration can invalidate per-socket bindings and lead to stale state if packet_set_ring resumes and re-registers from a saved was_running value. The fix restores po->num and marks the ...

EUVD-2026-55439

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packetsetring temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po-num, unregisters the...

EUVD-2026-55405

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

CVE-2026-68304 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

CVE-2026-68272

The CVE-2026-68272 affects the Linux kernel DRM/AMDGPU stack. It introduces a minimum-length validation for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), so undersized chunks (length_dw == 0) are now rejected with -EINVAL before pass2 dereferences data. Previously, a zero-size poi...

EUVD-2026-55373

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...