CVE-2026-75142

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75142 FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

EUVD-2026-62579

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75142 FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75142

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-45798 Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, comparewazuhversions in src/shared/versionop.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy but does not explicitly...

CVE-2026-45798 Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, comparewazuhversions in src/shared/versionop.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy but does not explicitly...

CVE-2026-45798 Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, comparewazuhversions in src/shared/versionop.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy but does not explicitly...

EUVD-2026-62574

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, comparewazuhversions in src/shared/versionop.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy but does not explicitly...

CVE-2026-44254

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

CVE-2026-20302 Cisco RoomOS Stack Overflow Vulnerability

A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is provided...

CVE-2026-44254

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

EUVD-2026-62554

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

CVE-2026-44254 Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

CVE-2026-44254 Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

CVE-2026-44254 Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

CVE-2026-44254

In Wazuh versions 1.0.0 through 4.14.5, the root-level remoted daemon (TCP port 1514) writes a null terminator beyond a stack buffer during zlib decompression of agent messages, causing a denial of service. Exploitation is unconfirmed; patch to 4.14.6 or 5.0.0-beta2. https://github.com/wazuh/wazu...

CLSA-2026-1787152014 Fix CVE(s): CVE-2025-5222

SECURITY UPDATE: stack buffer overflow in the genrb resource-bundle compiler - debian/patches/CVE-2025-5222.patch: replace the fixed-size 1024-byte subtag/typeKeyword stack buffers in addCollation, parseCollationElements and realParseTable with CharString in source/tools/genrb/parse.cpp, and add...

php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()

A flaw was found in PHP. A remote attacker could exploit this vulnerability by providing specially crafted inputs to the bccomp function. This could lead to an out-of-bounds write, resulting in stack and heap corruption. Such memory corruption can enable arbitrary code execution, allowing the...

CVE-2026-45741

Gotenberg (a Docker-powered stateless PDF API) versions 8.32.0 and earlier contain an SSRF deny-list bypass in the IsPublicIP function (pkg/gotenberg/outbound.go). The function fails to reject IPv6 transition prefixes (6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, deprecated site-local f...