CVE-2026-23002-5G-NAS-Message-Buffer-Overflow-in-gNodeB

CVE-2026-23002 – gNodeB における 5G NAS メッセージのバッファオーバーフロー プログラムコード（C シミュレーション） root@kitploit: // gnbnassim.c - Simulated 5G gNodeB parsing NAS Registration Request include include include define MAXIESIZE 128 void processregistrationrequestuint8t nasmsg, uint16t length uint8t iebufferMAXIESIZE; // Re...

CVE-2026-22013-Hardware-Wallet-USB-Descriptor-Buffer-Overflow

CVE-2026-22013 – Desbordamiento de búfer del descriptor USB en billetera de hardware Código del programa simulación de firmware en C root@kitploit: // hwwalletusb.c - USB descriptor parsing with fixed buffer include void handleusbsetupchar data, int len char descriptor32; if len 0 && data0 == 0x0...

CVE-2026-88832 Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

CVE-2026-88832 Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

CVE-2025-52413

CVE-2025-52413 — Particle Device OS BLE バッファオーバーフロー 発見者 : Golden Ticket Labs ベンダー : Particle 割当日 : 2025年8月12日 MITRE 概要 Particle Device OS v5.6.0 の blecontrolrequestchannel.cpp コンポーネントにおけるバッファオーバーフローにより、64バイトのバッファへの境界チェックのない memcpy が原因で、任意の関数ポインタの上書きが可能になります。 隣接する ThreadRunner::eventHandler...

EUVD-2026-80479

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

EUVD-2026-75364

An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11. The host streaming API function coinesreadstreamsensordata fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in commintfprocessstreamresponse...

EUVD-2026-75361

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...

CVE-2026-42805

CVE-2026-42805 is a stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library), specifically in the bhi385_parse_debug_message function within bhi385_parse.c. The root cause is that an 8-bit message length field is read directly from an attacker-controlled event payload and u...

EUVD-2026-75329

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-42804

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-42804

A stack-based buffer overflow exists in the Bosch Sensortec BHI360 SensorAPI (C-Library) , affecting versions up to and including commit d6b200416a. The flaw is in bhi360_parse_debug_message() (bhi360_parse.c, lines 1852–1875), where the first payload byte of a debug frame is used as a length and...

CVE-2026-80803 nfc: digital: clamp SENSF_RES length to the destination buffer

In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSFRES length to the destination buffer digitalinrecvsensfres memcpys resp-len bytes from a remote NFC-F device response into the NFCSENSFRESMAXSIZE-byte target.sensfres field without an upper-bound check. A...

CVE-2026-80796 nfc: nci: add data_len bound checks to activation parameter extractors

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...

ANT-2026-GSDN3H7W · OpenSC · Stack Buffer Overflow

stack-buffer-overflow low CVE-2026-40528 Severity Claude low · Security research firm low · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-GSDN3H7W: Stack buffer overflow in...

CVE-2026-43994

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decodeoauthtokengcm. A uint16t noncelen field read from an attacker-supplied OAuth access token 0-65535 is passed directly to memcpy as the copy length into a 256-byte...

Siemens RuggedCom Rox Out-of-bounds Write (CVE-2019-14194)

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfsreadreply when calling storeblock in the NFSv2 case. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens RuggedCom Rox Out-of-bounds Write (CVE-2019-14196)

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfslookupreply. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens RuggedCom Rox Out-of-bounds Write (CVE-2019-14198)

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfsreadreply when calling storeblock in the NFSv3 case. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens RuggedCom Rox Integer Underflow (Wrap or Wraparound) (CVE-2019-14199)

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a netprocessreceivedpacket integer underflow during an udppackethandler call. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...