CVE-2026-96675 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...

CVE-2026-96675

The alsa-lib library, through version 1.2.16.1 , is vulnerable to a denial of service (DoS) in the multi PCM plugin . The root cause is a failure to validate sparse binding indices before performing array access. A local attacker can provide a malicious ALSA configuration file containing sparse b...

EUVD-2026-85347

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...

CVE-2026-96675

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...

CVE-2026-96675 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...

CVE-2026-96674 alsa-lib through 1.2.16.1 Integer Overflow via Topology File

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

EUVD-2026-85346

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

CVE-2026-96674

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

CVE-2026-96674

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

UBUNTU-CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A...

gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

A flaw was found in GStreamer gst-plugins-good avidemux. In gstavidemuxriffparsevprp, the number of available gstriffvprpvideofielddesc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-fields value, rather than by sizeofgstriffvprpvideofielddesc. This ca...

CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-92164

The CLI utility Streamlink is vulnerable to a local file disclosure flaw in versions prior to 8.6.0 . The HTTPSession component mounts a FileAdapter for the file scheme but fails to reject cross-protocol redirects inherited from requests.Session. An attacker controlling a remote server reachable ...

CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the NMS component including Streaming Telemetry with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security...

CVE-2026-90407

A flaw was found in the Linux kernel's ath11k Wi-Fi driver. This vulnerability arises from insufficient validation of firmware input, specifically the numvdevs field, which is used as a loop bound without proper size checks. An attacker could exploit this to trigger an out-of-bounds read,...

Security update for gimp

This update for gimp fixes the following issues: Security issues fixed: CVE-2026-59088: denial of service via signed integer overflow in FLI file processing bsc1274837. CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow bsc1274840. CVE-2026-66757: signed integer...