DEBIAN-CVE-2026-66038

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

EUVD-2026-48740

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

GHSA-VC68-257W-M432 OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

Summary The PXR24 decompression function undopxr24impl in OpenEXR internalpxr24.c ignores the actual decompressed size outSize returned by exruncompressbuffer and instead reads from the scratch buffer based solely on the expected size uncompressedsize derived from the header metadata. Additionall...

GHSA-5GFQ-XRQ4-34RJ Duplicate Advisory: Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8j3x-m868-cpw8. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function...

CVE-2025-10995

Open Babel up to 3.1.1 is affected by CVE-2025-10995 due to a vulnerability in zlib_stream::basic_unzip_streambuf::underflow (in /src/zipstreamimpl.h) that can cause memory corruption. The ROS/REDOS entries confirm multiple Open Babel components (including ChemKinFormat, CacaoFormat, and SMILES p...

openbabel 缓冲区错误漏洞

openbabel is a chemistry toolkit software open-sourced by Open Babel. A buffer error vulnerability exists in openbabel 3.1.1 and earlier versions, which stems from a memory corruption issue in the zlibstream::basicunzipstreambuf::underflow function, which could lead to a local attack...

VulnCheck KEV: CVE-2009-1391

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...