By weakness (CWE)

CWE-131: related vulnerabilities

CVEs classified under CWE-131. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

12 published vulnerabilities

• CVE-2026-44420HIGH 8.8

  FreeRDP, a widely-used open-source Remote Desktop Protocol implementation, contains a flaw in its clipboard handling that allows an authenticated attacker to crash the RDP server or potentially execute arbitrary code. A malicious RDP client can send a specially crafted clipboard message with an invalid size parameter, causing the server to write past the bounds of allocated memory. This affects FreeRDP versions prior to 3.26.0. The vulnerability requires valid RDP credentials to exploit, limiting the attack surface to authenticated threat actors.

• CVE-2026-53091HIGH 8.4

  A vulnerability exists in how the Linux kernel handles network packets during transmission, specifically in code that processes Generic Segmentation Offload (GSO) packets. The kernel wasn't properly ensuring that packet headers were moved into the correct memory location before passing them to network drivers. This could allow a local user to craft malicious packets that crash the system or potentially cause other kernel instability. The issue has been addressed by ensuring headers are properly validated and moved into place, with the kernel now detecting and dropping obviously malformed GSO packets.

• CVE-2026-42055HIGH 8.1

  NGINX Plus and NGINX Open Source contain a heap buffer overflow vulnerability in their HTTP/2 and gRPC proxy modules. When specific configuration conditions are met—proxy_http_version set to 2 or grpc_pass enabled, ignore_invalid_headers turned off, and large_client_header_buffers exceeding 2MB—an attacker can craft oversized headers to trigger a buffer overflow. This can crash the NGINX worker process or, under certain circumstances (particularly when ASLR is disabled), lead to remote code execution. The vulnerability requires specific configuration and network conditions but poses significant risk to affected deployments.

• CVE-2026-2049HIGH 7.8

  GIMP contains a heap buffer overflow vulnerability in its HDR file parser that can lead to remote code execution. When a user opens a malicious HDR file or is tricked into visiting a compromised page hosting one, an attacker can overflow a memory buffer and execute arbitrary code with the privileges of the user running GIMP. The vulnerability requires user interaction but poses significant risk to creative professionals and any organization using GIMP for image processing workflows.

• CVE-2026-2050HIGH 7.8

  GIMP, the widely-used open-source image editor, contains a vulnerability in how it processes HDR (High Dynamic Range) image files. When a user opens a specially crafted malicious HDR file, an attacker can exploit improper input validation to overflow a memory buffer and execute arbitrary code on the affected system. This is a local attack that requires user interaction—an attacker cannot exploit it remotely without social engineering a user to open a malicious file.

• CVE-2026-53143HIGH 7.8

  A memory handling error in the Linux kernel's AMD GPU driver (amdkfd) causes a 1536-byte buffer overflow when saving or restoring GPU compute queue state on AMD Navi3x graphics processors. The driver incorrectly uses a larger data structure (2048 bytes) to read from or write to a smaller GPU memory region (512 bytes), allowing unauthorized access to adjacent memory and potential data corruption. This affects systems using AMD RDNA3 GPUs with the kernel's checkpoint/restore functionality (commonly used in container and virtual machine operations).

• CVE-2026-8357HIGH 7.8

  LibreOffice Calc has a critical flaw in how it processes spreadsheet formulas when opening files. The vulnerability occurs because the application allocates a buffer one element too small to handle extremely long, deeply nested formulas composed of many opening tokens. When such a formula is compiled, it writes past the buffer's boundary, corrupting adjacent memory. This heap buffer overflow can allow attackers to execute arbitrary code simply by convincing a user to open a malicious spreadsheet file.

• CVE-2026-10701HIGH 7.5

  Firefox's text rendering engine contains a flaw in how it validates memory boundaries when processing text data. An attacker on the network can exploit this without requiring user interaction or special permissions, allowing them to read sensitive information from the browser's memory. The vulnerability affects Firefox versions prior to 151.0.3.

• CVE-2026-0280HIGH 7.2

  Palo Alto Networks PAN-OS has a flaw in how it processes IPv6 traffic at the firewall level. An attacker on the network can craft malicious IPv6 packets that bypass the firewall's security policies, allowing blocked traffic to slip through to protected systems. This doesn't require authentication or user interaction—just the ability to send traffic toward the firewall. Cloud NGFW and Panorama deployments are unaffected.

• CVE-2026-42915MEDIUM 5.5

  Windows VMSwitch, the virtual networking component in Windows, contains a flaw in how it calculates memory buffer sizes. An attacker with local access to an affected system can exploit this miscalculation to crash the VMSwitch service, causing a denial of service. The attacker needs valid credentials to trigger the issue, so this is not a remote or unauthenticated attack vector. The vulnerability affects Windows 10, Windows 11, and Windows Server 2022/2025.

• CVE-2026-46521MEDIUM 5.5

  ImageMagick, a widely-used open-source image manipulation library, contains a flaw in its LZMA compression handling within the MIFF encoder. When processing specially crafted image files, the software can write data beyond allocated memory boundaries, potentially crashing the application or corrupting system memory. This vulnerability affects versions prior to 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch).

• CVE-2026-54696LOW 3.7

  Ruby JSON versions 2.9.0 through 2.19.8 contain a heap buffer overflow vulnerability in the JSON generator when handling streamed objects. If a JSON dump or generator operation receives a specially crafted object with an attacker-controlled string near 16 KB in size, the internal buffer can overflow, causing the application to crash. This is a denial-of-service issue that requires specific conditions to trigger but poses minimal impact to confidentiality or integrity. The vulnerability is fixed in version 2.19.9 and later.