CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

EUVD-2026-89201

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

EUVD-2026-89181

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102718

The NetX Duo SNMP addon contains a vulnerability in the _nx_snmp_utility_object_id_get function. The component fails to validate the claimed OID data length against the actual buffer size when using BER multibyte length encoding . A remote attacker can send a crafted SNMP packet with an OID lengt...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

EUVD-2026-89174

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

The ThreadX loadable-module loader contains two issues triggered when a device loads an attacker-controlled module via the _txm_module_manager_memory_load or _txm_module_manager_in_place_load APIs. Because these APIs accept only a base pointer without an image length, fields in TXM_MODULE_PREAMBL...

CVE-2024-5274

CVE-2024-5274 autores: @mistymntncop, @buptsb Reconocimiento a @buptsb por su gran contribución al descubrir tanto el POC de discrepancia de bytecode DCHECK como el descubrimiento de cómo elevar esa primitiva a primitivas más potentes de lectura/escritura fuera de límites OOB. Sin él, este exploi...

kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

A flaw was found in the Linux kernel's drm/amdgpu/vcn3 component. This vulnerability, an Out-of-Bounds OOB read, occurs when parsing decoder messages without proper boundary checks. A local attacker could potentially exploit this to read sensitive information from memory or cause system...

kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

A flaw was found in the Linux kernel's drm/amdgpu/vcn4 component. This vulnerability allows an attacker to trigger an out-of-bounds OOB read when parsing decoder messages due to insufficient bounds checking. This could lead to information disclosure, potentially revealing sensitive data from memo...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

A flaw was found in the Linux kernel's drm/amdgpu/vcn3 component. This vulnerability, an Out-of-Bounds OOB read, occurs when parsing decoder messages without proper boundary checks. A local attacker could potentially exploit this to read sensitive information from memory or cause system...

cve-2023-21987-poc

cve-2023-21987-poc Oracle VirtualBox VGA 越界读取漏洞 此概念验证（PoC）专为在 Windows 宿主机上运行的 Linux 客户机操作系统设计。 此 PoC 旨在演示泄漏 VirtualBox 组件地址的能力。你可能需要调整 vgaexp 函数内的指针值，以匹配你正在测试的特定版本。 目前，成功率相对较低。非常欢迎贡献以提高其可靠性。...

nftables-oob-read-write-exploit-CVE-2023-35001-

nftables oob read/write exploit CVE-2023-35001 Exploit used at pwn2own Vancouver 2023 on Ubuntu desktop. The exploit supports the kernel version available at the beginning of the event 5.19.0-35. Requirements C compiler Go compiler Usage Build $ make Run $ ./exploit This produces a lpe.zip file...

CVE-2022-1015

CVE-2022-1015 关于 Linux 内核中越界读取与写入漏洞的详细分析及本地权限提升概念验证代码。 你可以在我的博客上找到该漏洞的深入分析，同样你也可以在那里找到我对 nftables 的介绍。 重要说明 本仓库提供的漏洞利用代码不应期望在开箱即用的易受攻击内核版本上成功运行。 不同内核构建之间会存在许多偏移量差异，当然也包括不同的 ROP 小工具。 有时，由于内核构建之间的差异，甚至可能不得不改变利用漏洞的方式。例如，David Bouman @pqlqpql 对该漏洞的另一篇分析文章（可在此查看）中，他使用 UDP 数据包 来利用漏洞——针对处理 UDP...

CVE-2021-30632

From: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 El análisis de este error se puede encontrar aquí. Este es un error de Chrome reportado por un investigador anónimo y se cree que fue explotado en la naturaleza. El exploit aquí presentado se probó en ...

weightBufs

WeightBufs: WeightBufs es un exploit de lectura/escritura del kernel para todos los dispositivos Apple con soporte de Neural Engine. Errores y exploit por @simo36; puedes leer mis diapositivas de la presentación en POC para más detalles sobre las vulnerabilidades y las técnicas de explotación. El...

CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...