EUVD-2026-101137

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

EUVD-2026-101138

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Apsortcmp and...

CVE-2026-110715 MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Apsortcmp and...

CVE-2026-110714 libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

libsmb2 through 6.2 contains an integer underflow vulnerability in decodeacl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERYINFO reply,...

CVE-2026-110715

The MuJS JavaScript engine, versions 1.3.6 before 1.3.9 , contains a heap out-of-bounds read and write vulnerability in the Array.prototype.sort function. An attacker can supply JavaScript that inflates a dense array's length, causing the Ap_sort_cmp and Ap_sort_swap functions to access memory sl...

CVE-2026-110714

The libsmb2 library, versions through 6.2 , is vulnerable to a heap out-of-bounds read caused by an integer underflow in the decode_acl function. A malicious SMB server or an attacker intercepting an unsigned session can trigger this by sending a crafted QUERY_INFO reply with an AclSize value bel...

EUVD-2026-101136

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...

CVE-2026-110713

The libsmb2 library through version 6.2 is vulnerable to a heap out-of-bounds read in the smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info functions. This flaw occurs because malicious SMB servers can send crafted QUERY_INFO replies with oversized or missing name lengths, ca...

CVE-2026-110713 libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...

CVE-2026-110713 libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefilefsvolumeinfo and smb2decodefilefsattributeinfo that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERYINFO replies wi...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

EUVD-2026-101135

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712 libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110712

The libsmb2 library (versions through 6.2 ) contains a heap out-of-bounds read vulnerability within the smb2_decode_file_all_info function. The root cause is an unchecked FileNameLength parameter. A malicious SMB server or an attacker performing a man-in-the-middle attack on unsigned sessions can...

CVE-2026-110712

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2decodefileallinfo that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted...

CVE-2026-110661

The CGNS software (versions through 4.5.2 ) is vulnerable to a stack out-of-bounds read within the ADFI_read_node_header function. The root cause is a lack of proper null-termination in the end tag of .cgns or .adf files, which causes ADFI_stridx_c to scan past the disk_node_data memory. This vul...

CVE-2026-110660

The software vgmstream through r2117 contains a stack out-of-bounds read vulnerability within the G.722.1/Siren14 decoder (specifically in g7221_lib.c). The root cause is that the bit reader refills without verifying the data_u32 array end. An attacker can provide specially crafted .s14 or .sss f...

CVE-2026-110660 vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221lib.c, whose bit reader refills without checking the datau32 array end. Attackers can supply crafted .s14 or .sss files that drive decodevectorquantizedmltindices past the stack buffer...

CVE-2026-110661

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFIreadnodeheader that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFIstridxc to scan past disknodedata,...