13527 matches found
glib: GLib: Buffer underflow in GVariant parser leads to heap corruption
A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...
ALSA-2026:49512 Important: mingw-glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: GLib: Buffer underflow...
RHEL 8 : mingw-glib2 (RHSA-2026:49512)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49512 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...
iwd-security-poc
iwd 3.12 — four Wi-Fi parser/handler bugs Proof-of-concept co...
CVE-2026-67298
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
CVE-2026-67298
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
CVE-2026-67298
Summary: CVE-2026-67298 affects FreeRDP prior to 3.29.0. The server-side RAIL channel handler (rail_server_handle_messages in channels/rail/server/rail_main.c) is vulnerable. When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength without ...
CVE-2026-67298
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
EUVD-2026-51824
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
CVE-2026-67298 FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
CVE-2026-67298 FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
CVE-2026-67298 FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...
SUSE CVE-2026-66337
A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client...
CVE-2026-27654-PoC — Updated!
CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Handling PoC This repository provides a proof‑of‑concept exploit for CVE‑2026‑27654 , a heap‑overflow vulnerability in the ngxhttpdavmodule of nginx. The bug arises from a size‑t underflow when handling MOVE/COPY requests with specially craft...
JLSEC-2026-1086 libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow...
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...
EUVD-2026-51336
An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet...
Linux Distros Unpatched Vulnerability : CVE-2026-63362
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP...
PT-2026-76125
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2 cipher crypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploi...
Integer Underflow (Wrap or Wraparound)
Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the PubSub signature verification process. An attacker can cause a denial of service by sending a specially crafted UDP packet. Remediation Upgrade open62541 to version 1.4.20, 1.5.8 or higher...