miniupnpd_poc

Miniupnpd path that is greater than 526 bytes. The root cause is due to the lack of validating the return value of snprintf since snprintf returns the value of how many bytes it could of copied, not how many bytes it did copy. As of Jan-25-2019 the PoC within this repro has been successfully test...

CLEANSTART-2024-VR66903 Read out-of-bounds in PJSUA API when calling pjsua_recorder_create

Security vulnerability affects the pjproject package. Read out-of-bounds in PJSUA API when calling pjsuarecordercreate...

Astra Linux – vulnerability in linux-5.10, linux

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fixed read out-of-bounds in ubifswbufwritenolock The function ubifswbufwritenolock may access buf outside its bounds in the following process: ubifswbufwritenolock: alignedlen = ALIGNlen, 8; // Assume len = 4089, alignedle...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1737468474)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1737468474 advisory. - In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbo...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: Device name buffers passed to the device replace function are properly validated for string termination. This prevents a read out of bounds situation in the getnamekernel function. There is a syzbot report...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: crypto: arm64/poly1305 – fixed a read out-of-bound issue. A KASAN error was reported during fuzzing: BUG: KASAN: slab-out-of-bounds in neonpoly1305blocks.constprop.0+0x1b4/0x250 poly1305neon Read of size 4 at addr...

MINI-G5C8-3X7V-PW4X

Bulletin has no description...

CVE-2026-11743

The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...

EUVD-2026-52086

In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11036877; Issue ID: MSV-7132...

UBUNTU-CVE-2026-66401

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera...

TencentOS Server 3: perl-XML-LibXML (TSSA-2026:0767)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0767 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-58023 Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

Out-of-bounds Read vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-59145

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

PT-2026-61414

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the Linux kernel within the drm/amd/display component. The GPIO pin table parsers in the get gpio i2c info and bios parser get gpio pin info functions...

CVE-2026-15185 GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...

EUVD-2026-42191

During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the entity array. As a result, the application crashes...

K000162045: Go vulnerability CVE-2025-47914

Security Advisory Description SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. CVE-2025-47914 Impact An attacker may be able to cause a denial-of-service DoS...

binutils: GNU Binutils: Information disclosure or denial of service via out-of-bounds read in bfd linker

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may...

CVE-2026-53038

A flaw was found in the Linux kernel's Integrity Measurement Architecture IMA subsystem. When handling unsupported Trusted Platform Module TPM hash algorithms, the imafs component incorrectly accesses a hash algorithm name array, leading to a read out-of-bounds. This vulnerability could allow a...

CVE-2026-53038

In the Linux kernel, the following vulnerability has been resolved: imafs: Correctly create securityfs files for unsupported hash algos imatpmchip-allocatedbanksi.cryptoid is initialized to HASHALGOLAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be...