CVE-2026-43075

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2writeendinline KASAN reports a use-after-free write of 4086 bytes in ocfs2writeendinline, called from ocfs2writeendnolock during a copyfilerange splice fallback on a corrupted ocfs2 filesyst...

mediatek-mt8365-preloader-exploit

Analysis of Preloader Vulnerabilities in MediaTek MT8365 MT81...

openexr:openexr_exrcorecheck_fuzzer: Heap-buffer-overflow in DwaCompressor_uncompress

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=6091314944081920 Project: openexr Fuzzing Engine: afl Fuzz Target: openexrexrcorecheckfuzzer Job Type: aflasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Cras...

PT-2026-35482

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing a crafted .exr file with HTJ2K compression and a channel width of 32768 can write...

ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float

The JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats...

Linux Distros Unpatched Vulnerability : CVE-2026-5503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In TLSXEchChangeSNI, the ctx-extensions branch set extensions unconditionally even when TLSXFind returned NULL. This caused TLSXUseSNI to attach the...

DEBIAN-CVE-2026-5503

In TLSXEchChangeSNI, the ctx-extensions branch set extensions unconditionally even when TLSXFind returned NULL. This caused TLSXUseSNI to attach the attacker-controlled publicName to the shared WOLFSSLCTX when no inner SNI was configured. TLSXEchRestoreSNI then failed to clean it up because its...

assimp:assimp_fuzzer_collada: Stack-buffer-overflow in Assimp::ColladaLoader::CreateAnimation

Detailed Report: https://oss-fuzz.com/testcase?key=4815251051970560 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzercollada Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash Address: 0x78c321ee0d30 Crash State:...

GHSA-588R-CR5C-W6HF OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Summary internalexrundopiz advances the working wavelet pointer with signed 32-bit arithmetic: c wavbuf += nx ny wcount; Because nx, ny, and wcount are int, a crafted EXR file can make this product overflow and wrap. The next channel then decodes from an incorrect address. The wavelet decode path...

SUSE CVE-2026-34380

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undopxr24impl in src/lib/OpenEXRCore/internalpxr24.c at line 377. The...

EUVD-2026-19569

In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker has physical access to the device, with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09963054; Issue ID:...

ogre:ogre_deep_fuzz: Container-overflow in Ogre::Mesh::setLodStrategy

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=6040064055640064 Project: ogre Fuzzing Engine: afl Fuzz Target: ogredeepfuzz Job Type: aflasanogre Platform Id: linux Crash Type: Container-overflow WRITE 4 Crash Address: 0x78ca3cee0984 Crash State:...

Linux Distros Unpatched Vulnerability : CVE-2026-4775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by...

espeak-ng:ssml-fuzzer: Stack-buffer-overflow in LookupDict2

Detailed Report: https://oss-fuzz.com/testcase?key=6123080425734144 Project: espeak-ng Fuzzing Engine: afl Fuzz Target: ssml-fuzzer Job Type: aflasanespeak-ng Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x772a68820d1c Crash State: LookupDict2 LookupDictList...

qemu:qemu-fuzz-i386-target-generic-fuzz-es1370: Stack-buffer-overflow in clip_natural_int16_t_from_stereo

Detailed Report: https://oss-fuzz.com/testcase?key=4902304137674752 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-es1370 Job Type: libfuzzerasanqemu Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 2 Crash Address: 0x7ffeca06f7e0 Crash State:...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the WriteUHDRImage function when processing UHDR images with excessively large dimensions due to a signed integer overflow during pixel buffer size calculation. An attacker can cause a denial of service...

openjph:ojph_expand_fuzz_target: Stack-buffer-overflow in ojph::local::ojph_decode_codeblock_avx2

Project: https://github.com/aous72/OpenJPH.git Detailed Report: https://oss-fuzz.com/testcase?key=5660297254993920 Project: openjph Fuzzing Engine: libFuzzer Fuzz Target: ojphexpandfuzztarget Job Type: libfuzzerasanopenjph Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 2 Crash Address...

The vulnerability of the __write_overflow_field() function in the include/linux/fortify-string.h module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the writeoverflowfield function in the include/linux/fortify-string.h module of the Linux kernel is related to reading memory beyond the boundaries of the allocated buffer. Exploiting this vulnerability could allow an attacker to cause a service failure...

gpac:fuzz_probe_analyze: Stack-buffer-overflow in gf_text_process_sub

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4545441034469376 Project: gpac Fuzzing Engine: honggfuzz Fuzz Target: fuzzprobeanalyze Job Type: honggfuzzasangpac Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash Address: 0x75687aa3a8c...

CVE-2025-69419 Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

Issue summary: Calling PKCS12getfriendlyname function on a maliciously crafted PKCS12 file with a BMPString UTF-16BE friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption...