CVE-2026-68907

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-68907

The libIEC61850 library, an open-source implementation of IEC 61850 protocols, contains a server-side out-of-bounds stack read vulnerability in versions prior to 1.6.2 . The root cause is in the checkDataSetAccess function, which reverses the source and destination arguments when calling StringUt...

CVE-2026-68907 libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-68907 libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

EUVD-2026-102911

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-68907 libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-111154

A flaw was found in libtimidity. The SoundFont loader fails to properly validate generator operator values during file parsing, leading to a stack-based out-of-bounds write. By convincing a user to open a specially crafted SoundFont .sf2 audio file, an attacker can corrupt stack memory and crash...

CVE-2026-111131

A flaw was found in libxmp. An attacker could exploit an off-by-one stack out-of-bounds read in the P61A depacker by convincing a user or service to process a specially crafted audio module file. Successful exploitation could lead to an application crash, resulting in a Denial of Service DoS, or...

CVE-2026-55862

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CVE-2026-55862

The pupnp SDK, used for developing UPnP device and control point applications, is vulnerable to a stack overflow in versions prior to 2.0.0 . The vulnerability arises because several ixml DOM traversal functions —specifically ixmlPrintDomTreeRecursive, ixmlNode_getElementsByTagNameRecursive, ixml...

CVE-2026-55862 pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

CLSA-2026-1792162546 freeipmi: Fix of 3 CVEs

CVE-2026-85505: fix stack buffer over-read in ipmi-oem fujitsu get-sel-entry-long-text - CVE-2026-85506: fix stack buffer overflow in ipmi-oem dell get-system-info idrac-info - CVE-2026-85507: fix stack buffer overflow in ipmi-oem dell get-system-info cmc-info...

kernel: Bluetooth: MGMT: validate LTK enc_size on load

A flaw was found in the Linux kernel's Bluetooth management MGMT component. An attacker could exploit a vulnerability in how Long Term Keys LTK are loaded. By providing an oversized encryption size, a stack buffer overflow can occur, potentially leading to a denial of service...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization. A local user could trigger a stack buffer overflow by binding a specific type of Bluetooth socket with an excessive number of Bluetooth Isochronous Stream BIS entries. This memory corruption can lead t...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

SUSE CVE-2026-110661

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFIreadnodeheader that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFIstridxc to scan past disknodedata,...