CVE-2026-5056

A stack-based buffer overflow in GStreamer's qtdemux component allows attackers to execute arbitrary code via specially crafted input. This occurs due to insufficient data length validation when parsing UncompressedFrameConfigBox structures. Mitigation Do not open, preview, or auto-index untruste...

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

EUVD-2026-49768

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913

The CVE-2026-66913 vulnerability affects Lookyloo when processing uploaded captures and API submissions containing gzip/zlib-compressed HAR data. The root cause is unbounded decompressed size during in-memory processing of ZIP/gzip/zlib content, enabling a zip bomb to exhaust memory and disrupt s...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the heifimagehandlegetimagetiling function when processing a malformed uncompressed HEIF image item that has an associated uncC property but lacks an associated ispe property. An attacker can cause a crash by...

CVE-2026-47709

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC...

CVE-2026-47178

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

CVE-2026-47709

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC...

CVE-2026-47709

libheif (HEIF/AVIF decoder/encoder) has a null pointer dereference in heif_image_handle_get_image_tiling for malformed uncompressed image items with uncC but no ispe. In debug builds this triggers an ispe && uncC assertion; in release/ASan builds it can cause a null read at address 0xa8. Affected...

CVE-2026-47178 libheif has Heap Out Of Bounds Write in unci subsystem

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

EUVD-2026-46638

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

CVE-2026-47178 libheif has Heap Out Of Bounds Write in unci subsystem

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

EUVD-2026-43735

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path McIdas AREA files...

SUSE CVE-2026-54058

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes, getpixel,...

CVE-2026-61449

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header ZipArchive::statIndex'size' and rejects archives exceeding...

CVE-2026-61449

Summary of CVE-2026-61449 (Grav): Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM Installer. The new per-entry size bound (ZipArchive::statIndex()['size']) is summed against system.gpm.archive.max_uncompressed_size and blocks extraction before it, but the declared ...

CVE-2026-61449 Grav before 2.0.2 Decompression Bomb via Forged ZIP Size

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header ZipArchive::statIndex'size' and rejects archives exceeding...