46 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-102557
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the...
curl: IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser
Summary On 32-bit builds of libcurl, the IMAP FETCH handler truncates a server-announced literal size size from curlofft 64-bit to sizet 32-bit when it decides how many already-buffered bytes belong to the literal body. When a malicious or malfunctioning IMAP server announces a literal whose size...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate the file size. len is used to store the result of isizeread. Therefore, making len a sizet type results in truncation to 4GiB on 32-bit systems...
Linux Distros Unpatched Vulnerability : CVE-2026-89266
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - stbvorbis through 1.22 contains a heap buffer overflow in startdecoder where the codebook multiplicands allocation size is truncated from sizet to int. Attacker...
CVE-2026-89266
stb_vorbis (a single-file C library for Vorbis audio decoding) contains a heap buffer overflow in start_decoder() affecting versions through 1.22 . The root cause is a truncation of the codebook multiplicands allocation size from size_t to int, allowing a crafted Ogg Vorbis file with large entrie...
CVE-2026-89266
stbvorbis through 1.22 contains a heap buffer overflow in startdecoder where the codebook multiplicands allocation size is truncated from sizet to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes...
CVE-2026-89266 stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands
stbvorbis through 1.22 contains a heap buffer overflow in startdecoder where the codebook multiplicands allocation size is truncated from sizet to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes...
CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
AZL-98193 CVE-2026-80710 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...
CVE-2026-59985
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...
CVE-2026-59985 OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...
CVE-2026-59985
OpenEXR versions 3.2.0–3.2.10, 3.3.0–3.3.12, and 3.4.0–3.4.13 are vulnerable to a heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 builds . A crafted RLE-compressed EXR file causes a 64-bit unpacked size to truncate before allocation in decoding.c, leading unpack_32bit() to read beyon...
EUVD-2026-65695
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when ...
CVE-2026-53994 ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...
CVE-2026-53994 ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to...
FreeBSD Security Advisory - FreeBSD-SA-26:40.zfs
FreeBSD Security Advisory - The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. The ZFSIOCRECVNEW ioctl, in the heal receive path,...
CVE-2026-9137
The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive log volume and contribute to resource...
CVE-2026-42944
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options 'nsid', 'answer-cookie', 'pad-responses' default need to be enabl...