CVE-2026-85745

The MariaDB server versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are vulnerable to an out-of-bounds read in the ST_Area function. The root cause is that the multi-polygon parser advances past a nested geometry header without verifying if sufficient input remains w...

CVE-2026-85746

The MariaDB server (versions 10.6.1-10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2) is vulnerable to an out-of-bound buffer write in the ST_AsText function. This occurs during the conversion of deeply nested GeometryCollections because the recursive WKT serialization fails to reserve suff...

CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STAsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for...

EUVD-2026-100985

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...

CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...

CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...

kernel: drm/amdgpu/vce: fix integer overflow in image size

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

kernel: drm/amdgpu/vce: fix integer overflow in image size

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...

CVE-2021-4034

CVE-2021-4034 This contains single-file exploit for cve-2021-4034 which is a Polkit Local Privilege Escalation. Use it wisely! Vulnerability Description CVE-2021-4034, commonly referred to as Pwnkit , is a memory corruption vulnerability in the pkexec component of Polkit, a toolkit used for...

kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

A flaw was found in the Linux kernel's tunnels module. This vulnerability occurs when the iptunnelpmtudcheckicmp function is called without the skb transport header being properly set. An attacker could exploit this condition to trigger an out-of-bound memory access, which may lead to system...

CVE-2026-84854

The WibuKey driver for Windows versions below 6.72 contains an out-of-bounds write vulnerability due to insufficient validation of user input when calculating the size of a kernel buffer. This flaw could lead to a system crash or, under unfavorable circumstances, the modification of adjacent kern...

CVE-2026-84854 Out of Bound Write on WibuKey for Windows

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-84854 Out of Bound Write on WibuKey for Windows

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

A flaw was found in the Linux kernel's tunnels module. This vulnerability occurs when the iptunnelpmtudcheckicmp function is called without the skb transport header being properly set. An attacker could exploit this condition to trigger an out-of-bound memory access, which may lead to system...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop – Check the validity of the card index during the probe. The aloop driver blindly trusts that the given devptr-id value is within the appropriate card index range during the probe. It’s fine for the devices created by...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source project that provides a graphical login to remote machines using the Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contains a “Out of Bound Read” issue in the xrdpmmtransprocessdrdynvcchannelclose function. There are no known solutions to this problem. Users are advis...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Tunnels: Do not assume the transport header in iptunnelpmtudcheckicmp In some cases, iptunnelpmtudcheckicmp can be called while the skb transport header is not set. This triggers an out-of-bound access, because...

CLEANSTART-2024-ZP45224 FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data

Security vulnerability affects the ffmpeg4 package. FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data...

expat security update

2.7.3-61 - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing 2.7.3-60 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input 2.7.3-59 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog 2.7.3-58 - Fix CVE-2026-50219...

CentOS Linux 8 [TuxCare] Security Update: binutils / binutils-devel Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1777059908)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1777059908 advisory. - An issue was discovered in Binutils addr2line before 2.39.3, function parsemodule contains multiple out of bound reads which ma...