CVE-2026-102635

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image...

CVE-2026-102635

ImageMagick versions prior to 7.1.2-32 and 6.9.13-57 are vulnerable to an uninitialized heap memory disclosure within the GIF decoder's application extension handler in coders/gif.c. An attacker can craft a malicious GIF file that triggers the number parser to read uninitialized heap memory. This...

EUVD-2026-89030

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image...

CVE-2025-14847

CVE-2025-14847 CVE-2025-14847 漏洞环境及 PoC https://jira.mongodb.org/browse/SERVER-115508 摘要 这是一个关键修复，用于解决 CVE-2025-14847。请升级至 8.2.3、8.0.17、7.0.28、6.0.27、5.0.32 或 4.4.30 版本。 问题描述与影响 攻击者可通过客户端利用服务器 zlib 实现的漏洞，在未进行身份认证的情况下返回未初始化的堆内存。我们强烈建议尽快升级至已修复版本。 此问题影响以下 MongoDB 版本： MongoDB 8.2.0 至 8.2.3 MongoDB...

CVE-2026-93018: Use of Uninitialized Resource

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-54604: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile to request a full-height destination for a partial bottom tile row, allowing uninitialized...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 are affected by an information disclosure vulnerability in the Save Session Info PDU writers within libfreerdp/core/info.c. Three functions (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Ze...

CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-71394

A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. The parser can return a structure with uninitialized heap memory when a specially crafted font file is processed due to an improper validation. This can lead to the use of uninitialized heap data, potentially resulting in...

CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

Linux Distros Unpatched Vulnerability : CVE-2026-71394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the...

CVE-2026-71394: Improper Validation of Specified Quantity in Input

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

CVE-2026-70630

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

CVE-2026-70629 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

CVE-2026-70630: Use of Uninitialized Resource

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

CVE-2026-70629: Use of Uninitialized Resource

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...