9 matches found
CVE-2026-14266
CVE-2026-14266 — 7-Zip XZ 解码器堆缓冲区溢出 严重级别 | CVSS: 8.8（高危）| CWE-122：基于堆的缓冲区溢出 受影响版本：7-Zip ≤ 26.01 | 已修复版本：7-Zip 26.02（2026-06-25） 发现与分析：Li Yuxuan（liyuxuan504-byte）及其团队 执行摘要 7-Zip 版本 ≤ 26.01 的多线程 XZ 解码器路径 中存在堆缓冲区溢出漏洞。恶意构造的 .xz 压缩包可触发越过堆分配输出缓冲区的越界写入，从而导致： 拒绝服务（DoS） （已确认）——可稳定触发崩溃，错误码为...
CVE-2026-14266
CVE-2026-14266 PoC：7-Zip XZ 堆缓冲区溢出 PoC 生成器 用于复现 7-Zip 中 XZ 堆缓冲区溢出漏洞的概念验证（PoC）生成器。 该脚本会创建一个特制的 .xz 压缩包，旨在复现易受攻击的多线程 XZ 解压路径中的崩溃条件。 漏洞信息 CVE ：CVE-2026-14266 类型 ：堆缓冲区溢出 修复版本 ：26.02 或更高版本 组件 ：XZ 解码器 功能特性 从零开始生成有效的 .xz 压缩包 在易受攻击的 7-Zip 版本上复现崩溃条件 无需外部压缩包生成工具 使用方法 root@kitploit: python3 CVE-2026-14266.p...
Exploit for CVE-2026-14266
CVE-2026-14266 — 7-Zip XZ Decoder Heap Buffer Overflow Cr...
Exploit for CVE-2026-14266
CVE-2026-14266: 7-Zip XZ Heap Buffer Overflow PoC Generator P...
Siemens SIMATIC S7-1500 Premature Release of Resource During Expected Lifetime (CVE-2025-31115)
The threaded .xz decoder in liblzma has a vulnerability that can at least result in a crash denial of service. The effects include heap use after free and writing to an address based on the null pointer plus an offset. This plugin only works with Tenable.ot. Please visit...
FreeBSD : FreeBSD -- Use-after-free in multi-threaded xz decoder (7642ba72-5abf-11f0-87ba-002590c1f29c)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7642ba72-5abf-11f0-87ba-002590c1f29c advisory. A worker thread could free its input buffer after decoding, while the main thread might still be writin...
FreeBSD-SA-25:06.xz
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:06.xz Security Advisory The FreeBSD Project Topic: Use-after-free in multi-threaded xz decoder Category: contrib Module: xz Announced: 2025-07-02 Affects:...
Oracle Linux 10 : xz (ELSA-2025-7524)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7524 advisory. - Fix: heap-use-after-free bug in threaded .xz decoder CVE-2025-31115 Tenable has extracted the preceding description block directly from the Oracle Linux...
