CVE-2022-0185-Case-Study

CVE-2022-0185-Case-Study This case study is a result of an assignment of ECE 9069: Introduction to Hacking : https://whisperlab.org/introduction-to-hacking/ CVE-2022-0185 Overview CVE-2022-0185 is a heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesyst...

CLSA-2026-1792239628 gstreamer1-plugins-good: Fix of 2 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CLSA-2026-1792238729 gstreamer1-plugins-good: Fix of 4 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

CVE-2026-111075

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

EUVD-2026-107138

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

PT-2026-120494

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

EUVD-2026-105140

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure allows a malicious TLS 1.3 server to trigger an unsigned-integer underflow . This results in a heap out-of-bounds read in any peer processing a remote Certificate message. The vulnerability is reachable pre-authentica...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the pasteselection function, which releases the selection mutex lock during a loop. As a result, concurrent TIOCLINUX ioctl operations can reduce the vcsel.buflen to a value below pasted, leading to unsigned integer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netlink: Fixed wraparounds of sk-skrmemalloc. Netlink has this pattern in some places: c if atomicread&sk-skrmemalloc sk-skrcvbuf atomicaddskb-truesize, &sk-skrmemalloc; This issue was also fixed in commit 5a465a0da13e “udp: Fixe...

CVE-2026-92154 F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic a...

CVE-2026-92154

The F´ (F Prime) framework, used for spaceflight and embedded software applications, contains a file size bounds bypass in Svc::FileUplink prior to version 4.2.0 . The vulnerability stems from an unsigned integer overflow during DATA packet validation , where the component uses wrapping U32 arith...

CVE-2026-92154 F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic a...

CVE-2026-83742

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

EUVD-2026-94164

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2026-83742

The wolfSSL wolfSSH library (versions 1.4.11 through 1.5.0 ) is vulnerable to an unsigned integer underflow in the wstrncat() function located in src/port.c on non-Windows platforms. This flaw occurs because wolfSSH_RealPath() in src/ssh.c incorrectly uses a remaining-size bound (outSz - curSz) i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: printk: Fixed signed integer overflow when defining LOGBUFLENMAX. Shifting 1 31 on a 32-bit integer causes signed integer overflow, leading to undefined behavior. To prevent this, 1 was cast to u32 before the shift operation is...

MikroTik RouterOS Missing Authentication for Critical Function (CVE-2026-67277)

RouterOS accepts a related btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With random- data=false, the sender transmits an uninitialized tail from a kernel packet buffer. A separate...