CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

EUVD-2026-98684

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

CVE-2026-74045 Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fimgeneratealert where fulllog is sized from input but written bounded by OSMAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a...

CVE-2026-74045

Wazuh versions 3.12.0 before 4.14.8 are vulnerable to a heap buffer overflow in the fim_generate_alert() function of the wazuh-analysisd FIM Decoder. The issue occurs because full_log is sized based on the input but written with a boundary of OS_MAXSTR. An enrolled agent can trigger this by sendi...

EUVD-2026-98705

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

CVE-2026-109940

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

CVE-2026-109940

FreeRDP version 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support is vulnerable to a stack-based buffer overflow . The issue resides in the wprintKeyName() function within WinPR's NCrypt PKCS#11 provider, where a key's CKA_ID (up to 64 bytes) is hex-encoded into a fixed 128-byte stack...

CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS11 support has a stack-based buffer overflow in wprintKeyName in WinPR's NCrypt PKCS11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS11 token ...

CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

CVE-2026-109938

The FreeRDP remote desktop client, specifically versions 3.11.0 before 3.32.0 , is vulnerable to an integer overflow (CWE-190) during a mapped-video geometry update . When positive mapped-video coordinates overflow, the issue causes the FreeRDP client to abort. A malicious or compromised RDP serv...

CVE-2026-109938

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

CVE-2026-90109

A flaw was found in the Linux kernel. A local attacker with root privileges could exploit a 32-bit integer overflow vulnerability in the networking scheduler's gred, bfifo, and plug enqueue functions. This occurs when the queue backlog, stored as a 32-bit integer, exceeds 4 Gigabytes GiB. The...

CVE-2024-26170-extended

CVE-2024-26170-extended researching for CVE-2024-26170 or cimfs.sys to find overflows or bugs that is considered a zero-day...

CVE-2026-9256-POC

CVE-2026-9256-POC CVE-2026-9256 Nginx heap buffer overflow POC...

CVE-2026-90076

A flaw was found in the Linux kernel's fq Fair Queue packet scheduler. An integer overflow can occur in the fqinit function when calculating quantum and initialquantum values if a device is configured with an extremely large Maximum Transmission Unit MTU. This overflow leads to a zero value for...

CVE-2026-90075

A flaw was found in the Linux kernel's fqcodel network scheduler. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit this by configuring a network device with an extremely large Maximum Transmission Unit MTU. This can lead to an integer overflow, causing an infinite...

CVE-2026-90074

A flaw was found in the Linux kernel's fqpie network scheduler. A local attacker with CAPNETADMIN capabilities in a user namespace could exploit this by configuring a network device with a specially crafted large Maximum Transmission Unit MTU value. This can lead to a signed integer overflow,...