how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

VLC_CVE-2021-25804_Analysis

Un archivo AVI puede tener múltiples pistas. Por ejemplo, una pista de audio y una pista de video. Para analizar un número arbitrario de pistas, VLC primero debe determinar si una pista determinada está completa y es reproducible. Con este propósito se configuran dos variables. Ambas denominadas...

CentOS Linux 8.5 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.5:CLSA-2026:1788942887)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1788942887 advisory. - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote- forwarding operations are concurren...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.4:CLSA-2026:1788885099)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1788885099 advisory. - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote- forwarding operations are concurren...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1773928447)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1773928447 advisory. - In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to reall...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2026:1790071932)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790071932 advisory. - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote- forwarding operations are concurrent...

PT-2026-102681

Name of the Vulnerable Software and Affected Versions libexpat versions 2.7.2 through 2.8.5 Description An integer overflow occurs in the expat realloc function on 32-bit platforms during the computation of allocation sizes. An attacker can exploit this by providing malicious XML to applications...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2023-002133)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002133 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too fe...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: tools/nolibc/stdlib: fixed a memory error in realloc Pass userplen to memcpy, instead of heap-len, to prevent realloc from copying an extra sizeofheap bytes beyond the allocated region...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: “recordmcount”: Memory leaks have been fixed in the uwrite function. A common error in realloc: “file.Append” was set to null but was not freed upon failure...

Astra Linux – Vulnerability in netcdf

A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmlcharcontent attempts to use realloc on a block that has not been allocated, resulting in an invalid free operation and a segmentation fault...

CVE-2026-18743 Popt-devel: popt-static: short realloc in poptconfigfiletostring

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the poptConfigFileToString function reallocates memory for buffers...

CVE-2026-18743

popt (specifically the poptConfigFileToString function in popt-static/popt-devel) contains a short realloc bug that can cause heap metadata corruption when a host loads specially crafted configuration content. Successful exploitation results in a low-impact denial of service due to process unavai...

CVE-2026-18743 Popt-devel: popt-static: short realloc in poptconfigfiletostring

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the poptConfigFileToString function reallocates memory for buffers...

SUSE CVE-2026-72235

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80600

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80671 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

EUVD-2026-67477

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80600

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-80601

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...