ovn: ovn: Heap Over-Read in ICMP Error Response Generation

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length iptotlen for IPv4, ip6plen for IPv6 without validating it against the actual packet buffer size...

ovn: ovn: Heap Over-Read in ICMP Error Response Generation

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length iptotlen for IPv4, ip6plen for IPv6 without validating it against the actual packet buffer size...

CLSA-2026-1777456996 jasper: Fix of 3 CVEs

CVE-2021-26926: prevent out-of-bounds read in jp2decode by hard-erroring on inconsistent IHDR/BPCC component metadata - CVE-2021-26927: prevent out-of-bounds read in jp2decode by hard-erroring on inconsistent IHDR/BPCC component metadata - CVE-2021-3272: prevent heap-based buffer over-read in...

CVE-2026-41677

A flaw was found in rust-openssl, a library that provides OpenSSL functionalities for Rust applications. The library's password callback functions did not correctly check the size of data provided by a user's callback. This oversight could allow a specially crafted password callback to read beyon...

CLSA-2026-1777444043 ruby: Fix of 2 CVEs

CVE-2021-28965: fix REXML XML round-trip vulnerability - CVE-2022-28739: fix buffer over-read in String-to-Float conversion...

The vulnerability of the _rtl8812ae PhySetTxPowerLimit() function in the drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c file of the Realtek wireless driver for the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rtl8812ae PhySetTxPowerLimit function in the drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c file of the Realtek wireless driver for the Linux operating system is related to reading memory beyond the allocated buffer. Exploiting this vulnerability could allow an...

CLSA-2026-1777397602 gimp: Fix of CVE-2026-4887

CVE-2026-4887 fix heap buffer over-read in PCX file loader by adding bpp validation, tolerating off-by-one bytesperline values, and allocating one extra byte for line buffers...

CVE-2026-6238 Buffer overread in ns_printrrf with corrupted RDATA field

The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response,...

CVE-2026-6238 Buffer overread in ns_printrrf with corrupted RDATA field

The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response,...

CVE-2026-6238

The GNU C Library (glibc) versions 2.0.1 through 2.43 contain a vulnerability in the deprecated functions ns_printrrf , ns_printrr , and fp_nquery . The root cause is a failure to validate RDATA content against the RDATA length when processing A6, CERT, LOC, TKEY, or TSIG records in a DNS respons...

CVE-2026-41503

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's ReadPropertyMultiple service property decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending an RP...

CVE-2026-41475

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, an out-of-bounds read vulnerability in bacnet-stack's WritePropertyMultiple service decoder allows unauthenticated remote attackers to read past allocated buffer boundaries by sending a truncated W...

JLSEC-2026-238 Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug...

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The...

CLSA-2026-1777311274 Fix CVE(s): CVE-2026-22801, CVE-2026-25646

SECURITY UPDATE: Heap buffer over-read in pngwriteimage due to truncation of ptrdifft row stride to pnguint16 - debian/patches/CVE-2026-22801.patch: remove incorrect truncation casts from pngwriteimage16bit, pngwriteimage8bit, and pngimagewritemain so large 65535 and negative row strides are...

CLSA-2026-1777305047 expat: Fix of 3 CVEs

CVE-2017-9233: Fix external entity infinite loop bug - CVE-2018-20843: Fix extraction of namespace prefix from XML name - CVE-2019-15903: Deny internal entities closing the doctype heap overread...

JLSEC-2026-207

Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmapreg.c and adaptmap.c...

JLSEC-2026-206

Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c...

JLSEC-2026-209

Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c...

JLSEC-2026-208

Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c...

The vulnerability of the shared_cpu_map function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the sharedcpumap function in the Linux operating system relates to reading memory beyond the allocated buffer. Exploiting this vulnerability can allow an attacker to cause a service failure...