475512 matches found
CVE-2026-102162
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a...
CVE-2026-106547 HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...
CVE-2026-106547 HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...
CVE-2026-106547
HDF5 versions before 2.2.0 are vulnerable to a heap-based buffer overflow in the H5VM_array_fill() function located in src/H5VM.c . The root cause occurs when H5D__fill_init() fills a fill-value buffer using datatype and dataspace metadata from a file; if this metadata is inconsistent with the al...
EUVD-2026-93991
A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...
CVE-2026-106547
A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...
CVE-2026-106547 HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...
EUVD-2026-93983
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written throu...
CVE-2026-106062
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written throu...
CVE-2026-106062 Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written throu...
CVE-2026-106062
A heap-based buffer overflow exists in GIMP’s DirectDraw Surface (DDS) loader . When processing a crafted DDS image, the software performs 32-bit arithmetic that overflows during the calculation of buffer sizes based on width, height, and pitch (CWE-190 ). This results in the allocation of a buff...
CVE-2026-106062 Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written throu...
CVE-2026-106062
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface DDS loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written throu...
CVE-2026-61674
A flaw was found in Fluent Bit. A stack-based buffer overflow exists in the forward output plugin due to insufficient bounds checking on server responses during connection handshakes. A remote attacker controlling or impersonating a destination server can exploit this vulnerability by sending an...
CVE-2026-102162 Security Advisory 0193
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a...
CVE-2026-102162 Security Advisory 0193
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a...
EUVD-2026-93962
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a...
CVE-2026-102162
A vulnerability exists in the wireless gateway service of affected Arista Wi-Fi access points when a captive portal or application firewall is enabled on at least one SSID. An unauthenticated network-adjacent attacker can send a crafted packet to trigger a stack overflow (CWE-121). This may resul...
CVE-2026-106063 Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions
A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height and bytes-per-pixel product that can overflow. GEGL then writes the full uncompressed extent into th...
CVE-2026-106063
A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width height and bytes-per-pixel product that can overflow. GEGL then writes the full uncompressed extent into th...