100921 matches found
DEBIAN-CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
The Pillow Python imaging library (versions 9.1.0 through 12.x.x ) is vulnerable to an information disclosure flaw in the Image.quantize() function. When an empty palette is used, the ImagingPaletteCacheUpdate() function fails to initialize a local cache array, leading the conversion path to emit...
CVE-2026-76788
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CLSA-2026-1792444141 fribidi: Fix of CVE-2022-25308
CVE-2022-25308: fix stack-based buffer overflow...
GO-2026-6688 Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize...
GO-2026-6693 Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow process crash in github.com/corazawaf/coraza...
CLSA-2026-1792443100 c-ares: Fix of 2 CVEs
CVE-2022-4904: fix stack overflow in aressetsortlist due to missing input validation...
CVE-2026-76788
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
EUVD-2026-104600
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788
The Zephyr RTOS OSDP Control Panel reply parser contains a stack out-of-bounds write in cp_decode_response() within subsys/mgmt/osdp/src/osdp_cp.c. When processing REPLY_KEYPPAD or REPLY_RAW types, the parser fails to validate that the payload length stays within the fixed 64-byte OSDP_EVENT_MAX_...