JLSEC-2026-1095

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

CVE-2026-47178

CVE-2026-47178 affects libheif up to v1.21.2, where a crafted uncompressed HEIF image (unci codec, tiled, component-interleaved, 4:2:0) can trigger a heap out-of-bounds write in the uncompressed tile decoder. The write overwrites a nearby C++ vtable pointer, causing the next virtual call to dispa...

CVE-2026-47178

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

EUVD-2026-46638

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

Reverb use after free vulnerability

There exists a use after free vulnerability in Reverb.Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...

GHSA-W69Q-W4H4-2FX8 Reverb use after free vulnerability

There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...

SUSE CVE-2007-0245

Heap-based buffer overflow in OpenOffice.org OOo 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten...

Logic Print 2013 - Stack Overflow (vTable Overwrite)

No description provided by source. !-- Exploit Title: Logic Print 2013 stack overflow vTable overwrite Software Link: http://www.logic-print.com/ Tested on: Win XP SP3 French + Internet Explorer 8 Date: 29/05/2013 Author: h1ch4m Hicham Oumounid Email: [email protected] Twitter: @oh1ch4m Thanks to...

Logic Print 2013 - vTable Overwrite Stack Overflow

Logic Print 2013 - vTable Overwrite Stack Overflow var rop = ""; var shellcode = ""; var junk1 = ''; var junk2 = ''; function theMagicalMysteryTour rop = unescape"%u2230%u2030" + ///////////////////////////////////////////// /// STACK PIVOT /// /////////////////////////////////////////////...

Logic Print 2013 - Stack Overflow (vTable Overwrite)

Exploit for windows platform in category remote exploits var rop = ""; var shellcode = ""; var junk1 = ''; var junk2 = ''; function theMagicalMysteryTour rop = unescape"%u2230%u2030" + ///////////////////////////////////////////// /// STACK PIVOT /// /////////////////////////////////////////////...

openoffice.org rtf filter buffer overflow

Heap-based buffer overflow in OpenOffice.org OOo 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten...

CVE-2007-0245: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in OpenOffice.org OOo 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten...