186 matches found
The vulnerability of the `iris_hfi_gen1_session_unset_buffers()` function in the `drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c` driver for multimedia devices in the Linux operating system, which allows a hacker to cause a service failure.
The vulnerability of the irishfigen1sessionunsetbuffers function in the drivers/media/platform/qcom/iris/irishfigen1command.c driver for multimedia devices in the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow...
CVE-2026-9805
SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow...
The vulnerability of the amdxdna_cmd_get_payload() function in the drivers/accel/amdxdna/amdxdna_ctx.c driver for Linux kernel-based computing devices allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the amdxdnacmdgetpayload function in the drivers/accel/amdxdna/amdxdnactx.c driver for Linux computing devices relates to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow an attacker...
The vulnerability of the decode_mask_image() function in the libheif/image-items/mask_image.cc file, a decoder and encoder for libheif file formats, allows a hacker to trigger a service failure.
The vulnerability of the decodemaskimage function in the libheif/image-items/maskimage.cc file, a decoder and encoder for libheif file formats, is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause service...
CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read
Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...
CVE-2026-24076 Buffer Copy Without Checking Size of Input in Bluetooth HOST
Memory Corruption when processing registry values with incorrect types using a direct query method...
OPENSUSE-SU-2026:21228-1 Security update for glibc
This update for glibc fixes the following issues - CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write bsc1263656. - CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure bsc1263658...
The vulnerability of the SafeEmailFilter() function (/goform/SafeEmailFilter) in the Tenda F456 router software allows a hacker to execute arbitrary code or cause service failures.
The vulnerability of the SafeEmailFilter function /goform/SafeEmailFilter of the Tenda F456 router software lies in the copying of buffers without checking the size of the input data when processing the page parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or...
The vulnerability of the k12_dump_src_setting() function in the K12 file parser and RF5 traffic analyzer software from Wireshark allows a hacker to cause service interruptions.
The vulnerability of the k12dumpsrcsetting function in the K12 file parser and the RF5 traffic analyzer of Wireshark allows for buffer copying without checking input data. Exploiting this vulnerability can enable a hacker to cause service failures...
CVE-2025-47406 Buffer Over-read in DSP Service
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size...
EUVD-2026-19330
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing...
CVE-2025-47400 Buffer Over-read in Computer Vision
Cryptographic issue while copying data to a destination buffer without validating its size...
Astra Linux – Vulnerability in inetutils
In GNU inetutils’ telnetd module, as of version 2.7, there is a vulnerability where an out-of-bounds write can occur in the LINEMODE SLC Set Local Characters suboption handler. This occurs because the addslc function does not check whether the buffer is full before writing data...
ROS-20260401-73-0030
Vulnerability in libpng related to buffer copying without checking input size. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
The vulnerability of the ubifs_release_folio() function in the fs/ubifs/file.c module of the Linux kernel file system allows a attacker to cause a service failure.
The vulnerability of the ubifsreleasefolio function in the fs/ubifs/file.c module of the Linux kernel’s file system is related to copying buffers without checking their size a classic buffer overflow attack. Exploiting this vulnerability could allow an attacker to cause a service failure...
ROS-20260401-73-0039
Vulnerability in mongo-c-driver related to buffer copying without checking input data size. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
CVE-2026-32746
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC Set Local Characters suboption handler because addslc does not check whether the buffer is full...
CVE-2026-32746
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC Set Local Characters suboption handler because addslc does not check whether the buffer is full...
CVE-2026-32746
CVE-2026-32746 affects telnetd in GNU inetutils up to version 2.7. The vulnerability is an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler due to add_slc not verifying the buffer fill level. This can lead to memory corruption with potential impact on confidentiali...
CVE-2026-32746
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC Set Local Characters suboption handler because addslc does not check whether the buffer is full...