EUVD-2026-88556

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-101203

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-101203

A vulnerability exists in FastStone Image Viewer up to version 8.3 . The flaw resides in an unknown function within the 1bpp RLE Decoder component, where manipulation can trigger an out-of-bounds write . This vulnerability can be exploited via a remote attack . No specific remediation or exploit ...

CVE-2026-101203 FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-101203 FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not...

PT-2026-102383

Name of the Vulnerable Software and Affected Versions FastStone Image Viewer versions prior to 8.4 Description A remote attack can trigger an out-of-bounds write, which occurs when data is written outside the intended memory boundary, within an unknown function of the 1bpp RLE Decoder component...

CVE-2026-70653

A flaw was found in libvips. A heap-based buffer read overflow vulnerability exists in the old-style Radiance RLE decoder. A remote attacker could exploit this by providing a specially crafted Radiance image. This could lead to the disclosure of four bytes of adjacent heap data, potentially...

CVE-2026-70653

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanlinereadold and read q-1 before any prior pixel exists. A crafted Radiance...

CVE-2026-70653

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanlinereadold and read q-1 before any prior pixel exists. A crafted Radiance...

CVE-2026-70653: Heap-based Buffer Overflow

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanlinereadold and read q-1 before any prior pixel exists. A crafted Radiance...

CVE-2026-69159

This CVE is a duplicate of CVE-2026-67306; users should reference that identifier instead. The underlying vulnerability is an out-of-bounds read in FreeRDP prior to 3.29.0 , specifically in planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. The function...

CVE-2026-69159 FreeRDP: Out-of-Bounds Read in Planar RLE Decoder (planar_decompress_plane_rle / planar_decompress_plane_rle_only)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by th...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

EUVD-2026-51835

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

PT-2026-67286

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An out-of-bounds read exists in the RDP6 planar RLE bitmap decoder functions planar decompress plane rle and planar decompress plane rle only within libfreerdp/codec/planar.c. The system only perfor...

CVE-2026-43903

OpenImageIO is affected by CVE-2026-43903 due to a bounds-check issue in the SGI RLE decoder (sgiinput.cpp:265,274) where OIIO_DASSERT can be a no-op in release builds. A crafted .sgi with an RLE count exceeding the scanline width may cause a heap buffer overflow and crash. The vulnerability is f...

CVE-2026-43904

OpenImageIO prior to 3.0.18.0 and 3.1.13.0 has a heap overflow in the RLE decoder for the Softimage PIC path (softimageinput.cpp:469 and :345) because run length is not clamped to scanline width before writing pixels. The raw packet path clamps correctly, but the RLE paths do not, allowing a craf...

CVE-2026-43904 OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 mixed RLE and :345 pure RLE do not clamp the run length to remaining scanline width before writing pixels. The r...

CVE-2026-40494

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in tga.c has an asymmetric bounds check vulnerability. The run-packet path line 297 correctl...