102 matches found
CVE-2026-85769
CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...
cve-2022-49186-research
CVE-2022-49186: Linux Kernel Privilege Escalation Research Overview Security research and proof-of-concept exploit for CVE-2022-49186, a Linux kernel vulnerability in the Visconti clock driver that enables local privilege escalation through array overflow. Vulnerability Details Type : Array...
cve-2025-2082-POV
CVE-2025-2082 – Function Pointer Overwrite PoV VCSEC-style This repository demonstrates a Proof of Vulnerability PoV simulating a critical memory corruption flaw inspired by CVE-2025-2082, discovered in Tesla's VCSEC Vehicle Controller Security component. The vulnerability allows an attacker to...
CVE-2026-101937
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...
EUVD-2026-101489
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...
CVE-2026-101937 Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...
PT-2026-113792
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...
CVE-2026-101937: Signed to Unsigned Conversion Error
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic...
Signed to Unsigned Conversion Error
Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error due to unsigned leafindex values being compared as signed integers in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove. An attacker can exhaust heap memory and crash the JVM by sending a small...
Signed to Unsigned Conversion Error
Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error due to unsigned leafindex values being compared as signed integers in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove. An attacker can exhaust heap memory and crash the JVM by sending a small...
CVE-2026-17507: Signed to Unsigned Conversion Error
In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...
DEBIAN-CVE-2026-90114
In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...
CVE-2026-89612
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...
AZL-99918 CVE-2026-85769 affecting package libtpms for versions less than 0.9.6-9
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...
Exploit for CVE-2026-85769
CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0...
CVE-2026-85769
A heap out-of-bounds read in libtpms (software TPM 2.0 emulation, commonly deployed via swtpm in virtual machines) occurs during TPM 2.0 volatile-state restoration. An attacker-controlled oversized skip-block length in block_skip_read() drives a signed size counter negative; a subsequent signed-t...
CVE-2026-85769
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...
CVE-2026-85769 Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...
CVE-2026-85769
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...
PT-2026-86209
Name of the Vulnerable Software and Affected Versions libtpms affected versions not specified Description An issue exists in libtpms, a library for software TPM 2.0 emulation. During the restoration of TPM 2.0 state, such as during virtual machine power-on or migration restore, a malformed state...