8556 matches found
CVE-2026-107733
In SumatraPDF version 3.6.1 and earlier for Windows, a null-pointer dereference occurs within the FrameOnCommand() function when handling CmdExec while no document tab is open. The root cause is the passing of a null current-tab pointer to RunWithExe(), leading to the dereferencing of WindowTab::...
CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...
CVE-2026-107730
The multi-format reader SumatraPDF (version 3.7.0.22298 ) contains a signed integer overflow vulnerability in the LitParseHeader() function located in src/LitDoc.cpp . The issue occurs because the software uses signed 32-bit arithmetic to compute the section offset (hdrLen + nPieces * 16) without...
DEBIAN-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
EUVD-2026-95254
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
Out-of-Bounds Read
zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper 32-bit signed bounds checking of direct-ByteBuffer frame-size native methods, which allows an attacker to provide negative or overflowing offsets to read unintended memory locations, potentially causing JVM...
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
CVE-2026-106431
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
DEBIAN-CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106433
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...
CVE-2026-107386 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
CVE-2026-107386 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
CVE-2026-106431
The MongoDB C Driver contains a one-byte heap buffer overflow in the BSON bulk document writer . An off-by-one error allows a zero byte to be written past a heap allocation when a document ends at a specific buffer boundary. This vulnerability can lead to process memory corruption or a process te...
EUVD-2026-95152
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...