Linux Distros Unpatched Vulnerability : CVE-2026-111270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS...

UBUNTU-CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

Adobe FrameMaker 2022 < 17.0.10.928 (2022.0.10.928) / Adobe FrameMaker 2026 < 18.0.1.312 (2026.0.1.312) Multiple Vulnerabilities (APSB26-172)

The version of Adobe FrameMaker installed on the remote Windows host is prior to Adobe FrameMaker 2022 17.0.10.928 / Adobe FrameMaker 2026 18.0.1.312. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-172 advisory. - Adobe Framemaker is affected by an out-of-bound...

SUSE CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process...

SUSE CVE-2026-86846

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend...

SUSE CVE-2026-100229

A flaw was found in GStreamer's H.266 codec parser library libgstcodecparsers. An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could...

SUSE CVE-2026-100231

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin asfmux. When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane such as emoji to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE...

SUSE CVE-2026-100236

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

SUSE CVE-2026-110601

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gifinitframe in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent inde...

SUSE CVE-2026-110839

FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...

CVE-2026-89062

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error...

CVE-2026-89062

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error...

CVE-2026-89062

A potential out-of-bounds write vulnerability exists in the Lenovo Energy Management driver . This flaw could allow a local authenticated user to cause a blue screen error , resulting in a high impact on system availability. No specific exploit details or remediation steps are provided in the doc...

CVE-2026-111280

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...

CVE-2026-111275

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

AZL-110351 CVE-2026-111270 affecting package libmodplug 0.8.9.0-12

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

DEBIAN-CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

CVE-2026-111280

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...

CVE-2026-111275

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...