CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

CVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

CVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107274)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107274 advisory. In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9clientwrite and...

PT-2026-90328

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse ntfs boot sector decoded them into an s64. A crafted high-bit value could therefore becom...

CVE-2026-85769

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

PT-2026-86209

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

Astra Linux – Vulnerability in binutils

GNU binutils gold gold v1.11-v1.16 GNU binutils v2.21-v2.31.1 is affected by: Improper input validation, signed/unSigned comparison, out-of-bounds reading. The impact is: Denial of service. The component involved is: gold/fileread.cc:497, elfcpp/elfcppfile.h:644. The attack vector is: An ELF file...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing The sofparsetokensets function reads array-size while iterating over the topology private data. The loop condition only checks whether some data remains; therefore, a...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72300

The CVE-2026-72300 entry concerns the Linux kernel, specifically the ASoC: SOF topology parser. The vulnerability arises in sof_parse_token_sets() when it reads array->size during topology private-data parsing, potentially reading the size field before a complete snd_soc_tplg_vendor_array head...

CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

EEF-CVE-2026-55737 Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Summary Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binary\to\term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE\TUPLE\E...

CVE-2026-55737 Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

CVE-2026-55737 Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binarytoterm/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGETUPLEEXT term, the...

CVE-2026-55737

The CVE-2026-55737 issue is a heap-pointer corruption in Erlang/OTP’s erts external term format decoder. During LARGE_TUPLE_EXT decoding, the arity is read as unsigned in the validation pass but as signed in the decode pass, allowing 0x80000000 to produce -2147483648 and advancing the heap pointe...

CVE-2026-51536

In OpENer 2.3.0 commit 76b95cf when parsing incoming CIP Common Industrial Protocol network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 a 16-bit signe...