CVE-2026-112060

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-112051

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...

CVE-2026-112062

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

EUVD-2026-103504

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

CVE-2026-112062

The lwIP network stack (versions through 2.2.1 ) is vulnerable to a stack out-of-bounds write in the mdns_handle_response function. An adjacent attacker on the local link can exploit this by sending specially crafted mDNS responses during a service search—specifically, multicast PTR answers with ...

CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

CVE-2026-112062

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...

EUVD-2026-103522

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-112060 librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-112060

The librtmp library in RTMPDump versions through 2.6 is vulnerable to an out-of-bounds read and heap out-of-bounds write vulnerability. The root cause is that AMF3_Decode ignores AMF3 property decode failures. A malicious RTMP server or a man-in-the-middle attacker can exploit this by sending ove...

CVE-2026-112059

Versions of libLAS through 1.8.1 are vulnerable to a heap out-of-bounds write in the point record reader. The root cause is the truncation of the schema byte size to 16 bits when sizing the point buffer. An attacker can exploit this by crafting a .las file containing a LASSchema variable length r...

EUVD-2026-103521

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...

CVE-2026-112051

Xinference versions through 4.0.1 are vulnerable to a path traversal vulnerability on Windows systems. This flaw allows unauthenticated attackers to write or delete arbitrary .json files by using backslash sequences within the model_name parameter. Specifically, an attacker can register a persist...

EUVD-2026-103513

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...