Export limit exceeded: 16474 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16474 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-122056 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-11 | 5.9 Medium |
| A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS). | ||||
| CVE-2026-123828 | 2026-11-11 | 5.9 Medium | ||
| A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x. | ||||
| CVE-2026-110086 | 1 Adobe | 1 Premiere | 2026-11-11 | 7.8 High |
| Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-55737 | 1 Erlang | 3 Erlang/otp, Erlang\/otp, Erts | 2026-11-11 | 7.5 High |
| Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4. | ||||
| CVE-2026-86476 | 2 Red Hat, Redhat | 4 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 1 more | 2026-11-11 | 8.4 High |
| A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process. | ||||
| CVE-2026-110085 | 1 Adobe | 1 Premiere | 2026-11-11 | 7.8 High |
| Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-96020 | 1 Microsoft | 4 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 1 more | 2026-11-11 | 8.8 High |
| Out-of-bounds write in DNS Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-104352 | 1 Adobe | 1 Premiere | 2026-11-11 | 7.8 High |
| Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2025-43300 | 1 Apple | 7 Ios, Ipados, Iphone Os and 4 more | 2026-11-11 | 10 Critical |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. | ||||
| CVE-2026-124001 | 1 Nasajpl | 1 Iondtn | 2026-11-11 | 8.1 High |
| NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution. | ||||
| CVE-2026-105437 | 2 Git, Git-scm | 2 Git, Git | 2026-11-11 | 7.5 High |
| Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories. | ||||
| CVE-2026-86856 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-11 | 6.5 Medium |
| A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. | ||||
| CVE-2026-86849 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-11 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. | ||||
| CVE-2026-86846 | 2 Dpdk, Redhat | 4 Dpdk, Enterprise Linux, Openshift and 1 more | 2026-11-11 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. | ||||
| CVE-2026-100236 | 2 Dpdk, Redhat | 4 Dpdk, Enterprise Linux, Openshift and 1 more | 2026-11-11 | 8.6 High |
| A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write. | ||||
| CVE-2026-86565 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more | 2026-11-11 | 8.2 High |
| A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. | ||||
| CVE-2026-97185 | 2 Gimp, Redhat | 4 Gimp, Enterprise Linux, Rhel E4s and 1 more | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution. | ||||
| CVE-2026-90948 | 3 Gimp, Red Hat, Redhat | 5 Gimp, Enterprise Linux, Enterprise Linux and 2 more | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash. | ||||
| CVE-2026-90947 | 3 Gnome, Red Hat, Redhat | 5 Gimp, Enterprise Linux, Enterprise Linux and 2 more | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution. | ||||
| CVE-2026-124741 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 7.6 High |
| A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash. | ||||