CVE-2026-19185 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-19185 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-19185

In Zephyr RTOS builds with CONFIG_USERSPACE, a vulnerability exists in the i3c_do_ccc() system call handler within drivers/i3c/i3c_handlers.c. The system-call verifier fails to validate per-target data buffers, allowing an unprivileged user-mode thread with I3C controller access to provide arbitr...

CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

EUVD-2026-92285

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

CVE-2026-19184

The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) contains an out-of-bounds write vulnerability due to a mismatch between byte-based buffer size validation and sample-count logic. The driver incorrectly treats a byte count as the number of uint16_t slots, allowing a buffer to be overrun by ...

cve-2021-4034-mock

CVE-2021-4034 PwnKit Mock Vulnerability System Этот проект представляет собой имитационную систему, воспроизводящую ключевой принцип действия уязвимости CVE-2021-4034 Out-of-Bounds Read/Write в демоне pkexec для Linux. Без реального повышения привилегий SUID, в контролируемой среде безопасно...

CVE-2025-8110

CVE-2025-8110 — Gogs = 0.13.3 Arbitrary File Write via Symlink Traversal Overview Gogs = 0.13.3 is vulnerable to arbitrary file write through the PutContents API /api/v1/repos/:owner/:repo/contents/:path. The API validates file paths for directory-traversal sequences ../ but does not resolve...

CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4-byte XFRM/ESP Proof-of-concept local privilege escalation via XFRM/ESP page-cache corruption 4-byte write primitive · 48 iterations · 192-byte ELF overwrite · unprivileged user + netns Proof of concept Left: kernel preflight, setuid scan, and exploit chain · Right: root shell...

CVE-2026-105248

A security flaw exists in vgmstream up to version r2117 within the TXTP File Handler component. Specifically, the parse_params/txtp_parse function in the file src/meta/txtp_parser.c is vulnerable to an out-of-bounds write caused by malicious manipulation. This vulnerability may be exploited remot...

CVE-2026-105248 vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

CVE-2026-105248 vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

EUVD-2026-92274

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

CVE-2026-21045_and_CVE-2026-21048

CVE-2026-21045 и CVE-2026-21048 — Samsung libimagecodec.quram.so — PoC OOB-записи Обзор Этот репозиторий содержит концептуальные файлы Proof-of-Concept PoC, демонстрирующие уязвимости записи за пределами границ out-of-bounds, OOB в библиотеке кодека изображений Quramsoft libimagecodec.quram.so,...

cve-2024-32002-submodule-aw

CVE-2024-32002 Submodule AW A submodule to demonstrate CVE-2024-32002. Demonstrates arbitrary write into .git. See cve-2024-32002-poc-aw for the working POC that utilises this repo. What this repo contains Simply, a random file so that we can detect it when we clone the parent POC repo The file i...

CVE-2025-63602

CVE-2025-63602 Раскрытие информации о CVE-2025-63602, включающее PoC для использования небезопасного драйвера в Awesome Miner 11.2.4, приводящее к произвольному чтению/записи ядра в MSRs, что приводит к выполнению кода в режиме ядра...

CVE-2026-36227

CVE-2026-36227: PoC de traversée de chemin UserName dans Easy Chat Server 3.1 Ce dépôt contient une preuve de concept bénigne pour CVE-2026-36227, un problème de traversée de chemin dans la gestion des inscriptions utilisateur d'Easy Chat Server 3.1. Ce dépôt est destiné uniquement à la recherche...

CVE-2026-43284

Dirty Frag: 유니버설 리눅스 LPE 개요 이 문서는 Hyunwoo Kim @v4bel이 발견하고 보고한 Dirty Frag 취약점 클래스에 대해 설명합니다. xfrm-ESP Page-Cache Write CVE-2026-43284와 RxRPC Page-Cache Write CVE-2026-43500을 체이닝하여 공격자는 주요 리눅스 배포판에서 루트로 권한을 상승시킬 수 있습니다. Dirty Frag는 Dirty Pipe 및 Copy Fail과 동일한 버그 계열에 속합니다. 이는 타이밍 윈도우나 경쟁 조건에 의존하지 않...

CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal & Arbitrary File Write Authenticated This repository contains a Proof of Concept PoC exploit for CVE-2026-6815, an arbitrary file write and path traversal vulnerability in Casdoor. The vulnerability has been fixed in version 3.54.1...