By weakness (CWE)

CWE-787: related vulnerabilities

CVEs classified under CWE-787. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

210 published vulnerabilities · page 2 of 3

• CVE-2026-53136HIGH 7.8

  A vulnerability exists in the Linux kernel's AMD display driver where untrusted values from a system's BIOS firmware are used directly to control memory operations during driver initialization. An attacker with local access who can modify the BIOS firmware can specify invalid register counts that cause the driver to write data beyond allocated memory boundaries, potentially crashing the system or executing code with kernel privileges.

• CVE-2026-53137HIGH 7.8

  A vulnerability exists in the Linux kernel's AMD display driver that could allow a malicious HDMI repeater device to write data beyond the intended buffer boundaries on a system. When the system authenticates an HDMI repeater during HDCP 2.x security handshakes, it reads a message size value from the repeater without validating it against the actual buffer capacity. A malicious or compromised repeater could advertise an oversized message, triggering an out-of-bounds write and potentially allowing the attacker to corrupt memory or execute code with the privileges of the affected process.

• CVE-2026-53143HIGH 7.8

  A memory handling error in the Linux kernel's AMD GPU driver (amdkfd) causes a 1536-byte buffer overflow when saving or restoring GPU compute queue state on AMD Navi3x graphics processors. The driver incorrectly uses a larger data structure (2048 bytes) to read from or write to a smaller GPU memory region (512 bytes), allowing unauthorized access to adjacent memory and potential data corruption. This affects systems using AMD RDNA3 GPUs with the kernel's checkpoint/restore functionality (commonly used in container and virtual machine operations).

• CVE-2026-53148HIGH 7.8

  A flaw in the Linux kernel's Thunderbolt XDomain communication handler allows a malicious peer device to trigger a buffer overflow. The vulnerable function copies data based on a length value from an incoming packet without verifying it matches the actual allocated memory, enabling an attacker with local access to overwrite kernel memory and potentially gain elevated privileges.

• CVE-2026-53173HIGH 7.8

  A memory safety flaw in the Linux kernel's Arm Ethos-U NPU driver allows a local attacker to write data beyond the boundaries of an allocated buffer. The vulnerability exists in the command stream parsing loop, which fails to validate the buffer bounds after incrementing an index for 64-bit command words. An attacker with local access can craft a malicious command buffer via ioctl to trigger an out-of-bounds heap write, potentially corrupting kernel memory or escalating privileges.

• CVE-2026-53194HIGH 7.8

  A buffer overflow vulnerability exists in the Linux kernel's USB serial driver for Kleiner-Leibhaftig (KL5) devices. When writing data to a connected KL5 USB serial device, the kernel fails to account for a two-byte header that must fit within the output buffer, allowing user-space applications to trigger an out-of-bounds memory write. A local attacker with write access to a tty interface can crash the system or potentially execute arbitrary code in kernel memory.

• CVE-2026-53195HIGH 7.8

  A vulnerability exists in how Linux handles USB serial device firmware files. When processing firmware for certain USB-to-serial adapters (specifically Xsens motion trackers using TI chips), the kernel fails to properly validate the size of data being copied into a fixed-size buffer. An attacker with local access could supply a malicious firmware file that triggers a heap buffer overflow, potentially allowing code execution or system crash.

• CVE-2026-53209HIGH 7.8

  A vulnerability exists in the Linux kernel's Bluetooth advertising subsystem where a buffer overflow can occur when the system attempts to prepend Broadcast Announcement service data to an already-full advertising payload. The kernel fails to validate that the combined data will fit within available memory before attempting the operation, potentially allowing a local user with sufficient privileges to trigger a crash or execute code with elevated permissions. The fix adds a validation check to reject oversized combinations before the unsafe copy operation occurs.

• CVE-2026-55693HIGH 7.8

  Vim, the widely-used command-line text editor, contains a vulnerability in how it processes spell-check files. When a user loads a specially crafted spell file (with .spl or .sug extension) to enable spell suggestions, the editor's word-counting function descends through a data structure without properly validating its depth. This causes the function to write data beyond the boundaries of fixed-size memory buffers, corrupting Vim's execution state and crashing the application. The vulnerability requires user interaction—specifically, loading a malicious spell file—but no special privileges are needed, and the crafted files are straightforward to create.

• CVE-2026-57260HIGH 7.8

  CVE-2026-57260 is a memory safety vulnerability in Foxit PDF Editor and Reader that can be triggered when opening a specially crafted PDF file containing a malformed Unity 3D object. The application misinterprets data within the abnormal object as a valid memory pointer and attempts to use it, leading to a crash. An attacker could exploit this by distributing a malicious PDF that causes the application to crash when opened by a user, or potentially achieve more severe outcomes depending on how the pointer dereference is handled at runtime.

• CVE-2026-57455HIGH 7.8

  Vim versions before 9.2.0698 contain a stack buffer overflow in spell-checking functionality. When processing words longer than Vim's internal buffer limit (MAXWLEN) with certain spell file configurations, the editor writes data beyond allocated memory, corrupting the program's call stack and causing a crash. An attacker can trigger this by crafting a malicious spell file or providing oversized words during spell-checking operations, though the immediate impact is denial of service rather than code execution.

• CVE-2026-6676HIGH 7.8

  Avira Antivirus contains a memory corruption flaw in its scan engine that triggers when processing specially crafted tar archive files. An attacker who can get a user to scan a malicious tar file can exploit this to either run arbitrary code on the system with the victim's privileges or crash the antivirus engine, disabling active protection. The vulnerability affects Windows, macOS, and Linux installations running engine versions before 8.3.27.12.

• CVE-2026-8357HIGH 7.8

  LibreOffice Calc has a critical flaw in how it processes spreadsheet formulas when opening files. The vulnerability occurs because the application allocates a buffer one element too small to handle extremely long, deeply nested formulas composed of many opening tokens. When such a formula is compiled, it writes past the buffer's boundary, corrupting adjacent memory. This heap buffer overflow can allow attackers to execute arbitrary code simply by convincing a user to open a malicious spreadsheet file.

• CVE-2026-46123HIGH 7.7

  A vulnerability in the Linux kernel's Bluetooth virtio backend driver allows a malicious or buggy virtual device to expose uninitialized kernel memory to unprivileged processes. The driver fails to properly validate the length of data reported by the virtual device, permitting reads beyond the intended 1000-byte receive buffer. An attacker with the ability to control a virtio Bluetooth backend—such as a compromised hypervisor or malicious VM—can leak sensitive kernel heap data or trigger denial of service. This is a local attack requiring some form of device emulation control, but it directly compromises memory isolation guarantees in virtualized environments.

• CVE-2026-5068HIGH 7.6

  A vulnerability in Zephyr's Bluetooth host stack allows a nearby attacker to crash devices or corrupt memory by sending specially crafted Bluetooth Low Energy (BLE) packets. The flaw occurs when applications enable a feature called segmentation for handling large BLE messages, but configure their memory pools with insufficient space to track incoming data. An attacker within BLE range (typically 10–240 meters depending on device and antenna) can exploit this without any authentication, causing the device to crash or potentially enabling further compromise through heap corruption.

• CVE-2026-7831HIGH 7.6

  UltraVNC viewer versions up to 1.8.2.2 contain a stack buffer overflow vulnerability triggered when connecting to a malicious VNC server. The flaw occurs in how the viewer processes the server's desktop name during the initial connection handshake. If a server advertises a desktop name exactly 2024 bytes long, the viewer's buffer handling code writes a null terminator one byte beyond its allocated stack buffer. On systems without stack protection, this single-byte overflow can corrupt adjacent data; on systems with stack canary protection enabled, the corrupted canary causes the viewer to crash. An attacker must trick a user into connecting to their malicious VNC server to trigger the vulnerability.

• CVE-2026-0288HIGH 7.5

  Palo Alto Networks PAN-OS contains multiple buffer overflow flaws in the User-ID Terminal Server Agent (TSA) component that can be exploited over the network without authentication. An attacker can send malformed network traffic to trigger a denial of service or potentially run arbitrary code on affected firewalls. However, the risk is substantially reduced if you follow Palo Alto's deployment guidance and restrict TSA connectivity to trusted internal IP addresses only. Panorama appliances are not affected.

• CVE-2026-11690HIGH 7.5

  A memory safety vulnerability in Google Chrome's media handling on macOS allows an attacker who has already compromised the browser's renderer process to read and write memory outside intended boundaries. By hosting a malicious HTML page, the attacker can exploit this flaw to execute arbitrary code even within Chrome's sandbox environment. The vulnerability affects Chrome versions prior to 149.0.7827.103 on macOS.

• CVE-2026-12310HIGH 7.5

  A memory safety vulnerability was discovered in Firefox and Thunderbird that allows an attacker to read sensitive information from an affected system without requiring user interaction or special privileges. The flaw stems from improper memory handling in the browser engine and has been patched in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. No active exploitation has been reported to CISA as of this analysis.

• CVE-2026-12314HIGH 7.5

  A memory safety vulnerability in Firefox and Thunderbird allows an attacker to read sensitive data from affected browsers without user interaction. The flaw stems from unsafe memory handling that permits out-of-bounds reads. An attacker on the network can exploit this remotely to compromise the confidentiality of user data—such as cached credentials, browsing history, or page content—without requiring the user to click a malicious link or perform any action. The vulnerability does not enable data modification or system crashes.

• CVE-2026-12844HIGH 7.5

  List::Util::XS, a Perl module used to optimize list processing operations, contains a critical memory safety flaw in its pairwise() function. When the function processes pairs of values, it allocates memory to store results but fails to allocate enough space if a single block invocation returns a large amount of data. Specifically, the memory allocation strategy grows by only four times the current size in one step, but if a block returns more than that, the function writes beyond the allocated buffer, corrupting heap memory. Any application using pairwise() with a block that can produce large outputs in a single call is at risk of denial of service or potential code execution.

• CVE-2026-20458HIGH 7.5

  A memory corruption flaw in cellular modems could allow an attacker to gain elevated system privileges if a device connects to a malicious base station the attacker controls. The vulnerability requires the attacker to operate or compromise a base station, but once a user's phone or modem connects to it, no further interaction or special privileges are needed to exploit the flaw. This is a serious risk for any organization with field personnel or devices that roam across cellular networks.

• CVE-2026-42909HIGH 7.5

  A race condition flaw in Microsoft's Remote Desktop Client and related Windows components allows an attacker to execute malicious code on a target machine over the network. The vulnerability requires the user to interact with a malicious connection or file, but once triggered, grants the attacker the same privileges as the logged-in user. This affects multiple versions of Windows 10, Windows 11, Windows Server, and the standalone Windows App, making it a broad-reaching concern across enterprise environments.

• CVE-2026-42913HIGH 7.5

  A race condition flaw in Remote Desktop Client allows an attacker to execute arbitrary code on a Windows system by exploiting a window between when two processes access shared resources without proper locking. The attack requires network access and user interaction (such as establishing an RDP session), but successfully exploiting it grants full code execution with the privileges of the Remote Desktop Client process. This affects multiple Windows 11 versions and Windows Server 2022/2025.

• CVE-2026-44801HIGH 7.5

  A use-after-free vulnerability in Microsoft's Remote Desktop Client and Windows versions allows an attacker to execute code on your computer over the network. The flaw requires user interaction (such as clicking a link or opening a file) and specific system conditions, but once triggered, grants full control of the affected machine. This affects Remote Desktop Client, Windows App, and multiple Windows 10, 11, and Server editions.

• CVE-2026-46520HIGH 7.5

  ImageMagick, a widely-used image editing library, contains a memory safety flaw that can crash or destabilize applications when processing multiple images of different sizes. The vulnerability exists in versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). An attacker can trigger an out-of-bounds write by submitting specially crafted image files, leading to denial of service or potential code execution depending on system configuration and memory layout.

• CVE-2026-46604HIGH 7.5

  A vulnerability exists in Go's TIFF image decoder that can cause the application to crash when processing specially crafted TIFF files. The decoder fails to validate strip offset values properly, allowing an attacker to trigger a panic by supplying an out-of-bounds offset. This is a denial-of-service issue that affects any Go-based service handling untrusted TIFF images, particularly those exposed to the internet or processing user-supplied files.

• CVE-2026-47654HIGH 7.5

  A use-after-free memory vulnerability exists in the Remote Desktop Client component across multiple Windows Server versions. An attacker can exploit this flaw to execute arbitrary code on a target system over the network. The attack requires user interaction—specifically, a user must open a malicious RDP connection or file—but once triggered, an unauthenticated attacker gains the ability to run code with the privileges of the affected user. This is a network-reachable vulnerability with no authentication requirement, making it a material risk for organizations using Remote Desktop services.

• CVE-2026-48563HIGH 7.5

  A use-after-free bug in Microsoft's Remote Desktop Client can allow an attacker to run malicious code on a victim's machine over the network. The attacker would need to trick the user into connecting to a compromised or malicious Remote Desktop server, but once successful, they gain full control. This affects Windows 10 and Windows 11 systems, as well as Windows Server 2019, 2022, and 2025.

• CVE-2026-49475HIGH 7.5

  FreeSWITCH, a popular open-source telecom platform used to build VoIP and communication systems, contains a flaw in how it processes STUN packets—a protocol used for network address translation and firewall traversal in voice communications. An attacker sending a specially crafted STUN packet with a mismatched attribute length can cause the software to read and write beyond allocated memory buffers. This out-of-bounds memory access occurs in the media buffer handling logic and can crash the affected FreeSWITCH instance, disrupting voice and video services. The vulnerability affects all versions prior to 1.11.0.

• CVE-2026-53461HIGH 7.5

  ImageMagick, a widely-used open-source image processing suite, contains a flaw in its ICON file decoder that can trigger an out-of-bounds memory write. When processing a specially crafted ICON file, the decoder's loop logic fails to properly validate boundaries, allowing data to be written beyond allocated heap memory. This results in application crashes and potential memory corruption. The vulnerability affects ImageMagick versions prior to 6.9.13-50 (legacy branch) and 7.1.2-25 (current branch).

• CVE-2026-54592HIGH 7.5

  Oj is a widely-used Ruby gem for parsing and marshalling JSON data. Versions before 3.17.3 contain a stack buffer overflow vulnerability triggered when the Oj::Doc#each_child method is called recursively on deeply nested JSON. The vulnerability stems from a missing bounds check and a missing restoration of an internal pointer (doc->where) during recursive traversal. An attacker can craft a malicious JSON document with excessive nesting depth to overflow a fixed 800-byte stack buffer, causing the Ruby process to crash. This results in a denial-of-service condition affecting any application using vulnerable Oj versions to parse untrusted JSON input.

• CVE-2026-55687HIGH 7.5

  A flaw in Espressif's IoT Development Framework (ESP-IDF) allows attackers to crash devices by sending specially crafted JPEG image data over the network. The vulnerability exists in the JPEG parser's handling of a specific image marker type (DQT, or Quantization Table). When processing these markers, the code fails to validate that a user-supplied index value stays within safe bounds, causing it to write data to unintended memory locations. This corrupts the device's stack and reliably triggers a denial of service, making the affected device unresponsive. No credentials or user interaction are required—an attacker on the network can trigger the crash remotely.

• CVE-2026-55958HIGH 7.5

  A memory corruption vulnerability exists in WolfSSL's Renesas TSIP TLS 1.3 implementation that allows a remote attacker to crash a device by sending an oversized TLS handshake message. The underlying flaw occurs because the code checks whether incoming transcript data exceeds a fixed 8 KB buffer but neglects to stop processing after flagging the error—instead, it continues copying data anyway, writing beyond the buffer boundary. This heap corruption can trigger a denial of service on affected embedded systems. The vulnerability only manifests when using the specific Renesas TSIP hardware acceleration on compatible Renesas microcontrollers running WolfSSL with TLS 1.3 client mode enabled.

• CVE-2026-57876HIGH 7.5

  GeoVision's GV-LPC2011 and GV-LPC2211 network cameras contain a memory safety flaw in their web interface that allows unauthenticated attackers to crash the device. An attacker can send a specially crafted HTTP request to the onvif.cgi endpoint with oversized input data, causing the application to write beyond allocated memory boundaries. This memory corruption reliably triggers a denial-of-service condition, rendering the camera unavailable until reboot.

• CVE-2026-6325HIGH 7.5

  A memory corruption vulnerability exists in WolfSSL's signature algorithm processing code. When the library receives a specially crafted TLS message with an abnormally large list of signature algorithms, it writes data beyond the allocated buffer boundaries. This out-of-bounds write can corrupt adjacent memory, potentially allowing an attacker to modify application behavior or crash the service. The flaw requires no authentication and can be triggered over the network during the TLS handshake.

• CVE-2026-6679HIGH 7.5

  A memory corruption flaw exists in wolfSSL's DTLS 1.3 implementation that allows an unauthenticated remote attacker to crash affected services. The vulnerability stems from incorrect math when calculating the size of a data structure, resulting in a smaller buffer being allocated than needed. When the code then writes data into this undersized buffer, it corrupts adjacent memory and triggers a denial of service. This can happen before the connecting peer has proven its identity, making it exploitable by anyone on the network.

• CVE-2026-13592HIGH 7.3

  A flaw in liftoff-sr CIPster allows an attacker on the network to send specially crafted EtherNet IP messages that cause the BufWriter::append function to write data beyond allocated memory boundaries. This out-of-bounds write vulnerability can corrupt data, crash the service, or potentially enable code execution. The vulnerability affects versions up to commit e8e9dba09bf56962807d3504b783ccdb6287f3e4, and a public exploit is now available, making active exploitation more likely.

• CVE-2026-6040HIGH 7.3

  CVE-2026-6040 is a memory safety vulnerability in ODF (Open Document Format) number format parsing. When a document contains a malformed number format with blank-width characters, a position value embedded in that format is not validated before being used to access the format-code string. This can cause the application to read from memory outside the intended buffer—a use-after-free condition. An attacker who crafts a malicious ODF document with a specially formed number format could trigger this flaw, potentially leading to information disclosure, data corruption, or application crash when the document is opened by a user.

• CVE-2026-13053HIGH 7.2

  WatchGuard Fireware OS contains a flaw in its command-line interface (CLI) that allows authenticated administrators with elevated privileges to run arbitrary code on affected firewall devices by submitting a specially crafted command. This is a memory-writing vulnerability that bypasses normal access controls once an attacker has gained administrative credentials.

• CVE-2026-13383HIGH 7.2

  WatchGuard Fireware OS contains a memory vulnerability in its ikestubd process that allows authenticated administrators to execute arbitrary code through the Management Web UI. An attacker with legitimate privileged credentials can send specially crafted requests that trigger an out-of-bounds write, potentially compromising the firewall's integrity and enabling lateral movement within protected networks. This threat is elevated by the widespread deployment of affected Firebox models across enterprise and mid-market security infrastructures.

• CVE-2026-13384HIGH 7.2

  WatchGuard Fireware OS contains an out-of-bounds write flaw in the wgagent process that allows authenticated administrators to execute arbitrary code on the firewall. An attacker with valid admin credentials could send specially crafted requests through the Management Web UI to trigger the vulnerability and gain complete control of the device. This is a serious issue because firewalls are critical security infrastructure; compromise of one could allow an attacker to bypass network defenses entirely.

• CVE-2026-7829HIGH 7.2

  UltraVNC Repeater versions up to 1.8.2.2 contain a stack-based buffer overflow in the settings parser used by the web-based admin interface. When an authenticated administrator configures allow/deny rules with unusually long tokens, the application writes a null terminator past the end of its internal buffer, overwriting adjacent stack memory. An attacker with admin credentials can exploit this to execute arbitrary code on the repeater machine. While direct admin access is normally required, this risk is amplified if an organization has been exposed to the related default-credentials vulnerability (CVE-2026-7839).

• CVE-2026-10641HIGH 7.1

  A vulnerability in Zephyr's Bluetooth Classic implementation allows a remote device to crash or corrupt memory on systems running vulnerable builds. When a Zephyr device establishes a Bluetooth connection using the Hands-Free Profile, it expects responses from the remote device that follow a defined format. An attacker controlling or spoofing the remote device can send a malformed response with an unusually long list of indicators, bypassing safety checks and writing data into unintended memory locations. This memory corruption can disable Bluetooth functionality and potentially affect system stability. The vulnerability requires the attacker to be within Bluetooth range and does not require user interaction to trigger.

• CVE-2026-10658HIGH 7.1

  A buffer handling flaw in Zephyr's Bluetooth ISO receive path allows an attacker with access to an established Bluetooth connection to read and write memory beyond buffer boundaries. When processing incoming ISO data packets, the code fails to validate that the packet contains enough bytes before extracting header information. An attacker on a compromised or adjacent Bluetooth device can craft malicious packets to cause out-of-bounds reads that corrupt data structures, and in multi-packet scenarios, trigger out-of-bounds writes that overwrite critical memory regions. The vulnerability affects Zephyr versions 2.6.0 through 4.4.0 when Bluetooth ISO receive functionality is enabled (typically for LE Audio applications).

• CVE-2026-47150HIGH 7.1

  EmberZNet, Silicon Labs' Zigbee networking stack, contains a flaw in how it processes enrollment messages from the IAS (Intruder Alarm System) Zone cluster. A device already connected to the network can send specially crafted enrollment packets that cause the software to write data beyond the intended boundaries of a state table, crashing the process. The vulnerability is confined to network-adjacent attackers with prior network membership and only affects devices that implement IAS Zone functionality.

• CVE-2026-47151HIGH 7.1

  CVE-2026-47151 is a memory safety vulnerability in Silicon Labs' EmberZNet v9.0.2 and earlier that allows an authenticated network attacker to corrupt Door Lock cluster state by sending specially crafted schedule messages. An attacker who has already joined the Zigbee network can trigger out-of-bounds memory writes, potentially disabling or malfunctioning door lock scheduling features. The vulnerability is contained to devices implementing the Door Lock cluster and does not permit remote code execution, but it can degrade the availability and integrity of lock functionality.

• CVE-2026-49295HIGH 7.1

  libde265, an open-source H.265 video codec library, contains a flaw where a specially crafted video file can cause the decoder to write data beyond the boundaries of an internal array. This happens during the processing of reference picture sets—a critical step in decoding H.265 video. The vulnerability can lead to application crashes or memory corruption, affecting any system that uses libde265 to decode H.265 video streams. The issue was patched in version 1.0.20.

• CVE-2026-49839HIGH 7.1

  jq is a widely-used command-line tool for processing JSON data. This vulnerability exists in how jq handles very large files when using the `--rawfile` option. When jq reads an oversized file, it is supposed to stop and report an error once the file exceeds the string size limit. However, in versions before 1.8.2, the error handling is incomplete: the tool continues trying to read more data from the file even after detecting it is too large. This causes jq to write data to memory locations it shouldn't access, potentially leading to a crash or allowing an attacker to execute code. An attacker would need to trick a user into running jq on a specially crafted large file.

• CVE-2026-53041HIGH 7.1

  A flaw in how the Linux kernel's OCFS2 filesystem reports extended file attributes (xattrs) can cause a kernel crash when listing these attributes on files that store them in multiple locations. When a file's inline xattrs exactly fill a user's buffer and there are additional xattrs stored in blocks, the kernel incorrectly reports a size that exceeds the buffer and then attempts to write beyond it, triggering a kernel panic. This affects systems using OCFS2 as their filesystem, particularly in Oracle environments and high-availability clusters.

• CVE-2026-53187HIGH 7.1

  A vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem where user-supplied CPU IDs are not properly validated before being used in system operations. An attacker with local access can supply an invalid CPU ID that causes the kernel to read memory outside the valid CPU bitmap range, potentially exposing sensitive information or crashing the system. This is particularly dangerous on systems configured to panic when kernel warnings are triggered.

• CVE-2026-53203HIGH 7.1

  A buffer overflow vulnerability exists in the Linux kernel's Intel VPU (Vision Processing Unit) acceleration driver. When the driver queries metric stream information from firmware, it does not properly validate whether the returned data size exceeds the allocated buffer. An attacker with local access could trigger this condition, potentially leading to information disclosure or system instability. The vulnerability affects systems running vulnerable Linux kernel versions with the Intel VPU driver enabled.

• CVE-2026-53205HIGH 7.1

  The Linux kernel contains a vulnerability in the Intel VPU (Video Processing Unit) acceleration driver where firmware-supplied log buffer indices are not properly validated. When the firmware provides read or write indices that fall outside the valid range of the log buffer, the kernel does not catch this before using them to access memory. This can lead to the kernel reading from or writing to unintended memory locations, potentially exposing sensitive data or causing system instability. The fix adds validation to ensure indices stay within bounds and clamps out-of-range values to safe defaults.

• CVE-2026-56209HIGH 7.1

  A critical flaw exists in libaom, the open-source reference implementation of the AV1 video codec. An attacker can craft malicious video frames that exploit a missing validation check in the Scalable Video Coding layer, allowing them to write data to arbitrary memory locations on a system running a vulnerable encoder. This could crash the encoder (denial of service) or potentially allow the attacker to execute arbitrary code. The vulnerability is particularly dangerous because it requires no prior information disclosure to exploit—an attacker who can feed frames to a network-accessible encoder, such as in a transcoding service or live stream ingestion pipeline, can trigger the flaw reliably.

• CVE-2026-56211HIGH 7.1

  A vulnerability in libaom, the open-source AV1 video codec library, allows an attacker to execute arbitrary code on systems that process untrusted video files with scalable video coding (SVC) features enabled. An attacker crafts malicious video frames that bypass safety checks in the encoder, allowing them to corrupt memory structures that control how the encoder operates. In services that spawn separate processes to handle video encoding, this memory corruption can be leveraged to discover the process layout in memory and ultimately redirect execution to attacker-controlled code. Exploitation requires that the target application uses libaom with SVC encoding active and processes video frames from an untrusted source.

• CVE-2026-59691HIGH 7.1

  A flaw in GStreamer's RFB/VNC plugin (rfbsrc) allows a remote attacker to crash applications or corrupt memory when a user connects to a malicious video streaming server. The vulnerability stems from a mismatch between expected and actual data sizes: the plugin allocates a buffer for 16-bit pixel values but then writes 32-bit values into it during certain screen update operations. An attacker controlling a fake RFB server can exploit this by advertising a 16-bit display mode and sending specially crafted graphical updates, triggering a heap overflow that impacts any GStreamer-based media application using the rfbsrc plugin.

• CVE-2026-59948HIGH 7.0

  Composer, the widely-used PHP dependency manager, contains a vulnerability that allows attackers to place malicious files anywhere on a developer's system during package installation or updates. An attacker who controls a third-party repository can craft a package with an invalid name that bypasses validation checks, letting them write files outside the intended vendor directory. This is a local-impact vulnerability requiring user interaction (installing or updating packages), but the consequences are severe: an attacker can modify system files, inject code into projects, or disrupt operations. The issue affects all versions of Composer before 2.2.29 and 2.10.2.

• CVE-2026-53196MEDIUM 6.8

  A vulnerability in the Linux kernel's USB serial driver for IO Technic devices allows a malicious USB device to overflow kernel memory when connected to a host system. The driver fails to properly validate the size of data it reads from a device's onboard memory, trusting an untrusted value from the device itself. When a crafted device is plugged in, it can write far more data into a small kernel buffer than it was designed to hold, potentially leading to code execution or system crash.

• CVE-2025-10238MEDIUM 6.7

  A vulnerability in ThinkPad BIOS could allow someone with administrative or system-level access to a machine to write data outside intended memory boundaries, potentially enabling them to execute malicious code at the System Management Mode (SMM) level. SMM is a privileged processor mode that runs independently of the operating system, giving an attacker the ability to compromise the system at its deepest firmware level.

• CVE-2025-59614MEDIUM 6.7

  A memory corruption flaw exists in multiple Qualcomm components when processing random number generator commands with an undersized output buffer. An attacker with high-level privileges on the local system can trigger this condition to corrupt memory, potentially achieving confidentiality, integrity, and availability compromise. The vulnerability requires administrator or equivalent access and cannot be exploited remotely.

• CVE-2026-20453MEDIUM 6.7

  CVE-2026-20453 is a local privilege escalation vulnerability in MediaTek's geniezone component affecting multiple SoC (System-on-Chip) firmware and chipsets. The flaw stems from missing bounds validation during a write operation, allowing an attacker who already has system-level privileges to escalate further or corrupt memory. Because the attack requires prior system access and involves no user interaction, this is a post-compromise risk rather than an initial attack vector. The vulnerability carries a CVSS 3.1 score of 6.7 (Medium severity).

• CVE-2026-10999MEDIUM 6.5

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer) within Google Chrome on Windows. Before version 149.0.7827.53, this flaw could allow an attacker who already controls the Chrome renderer process to read sensitive data from memory by tricking a user into viewing a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-13873MEDIUM 6.5

  A memory reading flaw in Google Chrome's Layout component allows attackers to trick users into visiting a malicious webpage that reads sensitive data from the browser process. The attacker gains no ability to modify data or crash the system, but can potentially expose information that should remain private. This affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-28979MEDIUM 6.5

  An out-of-bounds memory access vulnerability exists in Apple's Safari browser and related Apple operating systems. When a user visits a malicious website, the flaw can crash the affected application unexpectedly. The vulnerability stems from insufficient bounds checking when processing web content, allowing an attacker to read from or write to memory locations outside intended boundaries. No data theft or system compromise occurs; the impact is limited to denial of service through application crashes.

• CVE-2026-3088MEDIUM 6.5

  A vulnerability in Netgear mesh router systems allows attackers on the local network to crash the router or knock it offline by sending specially designed requests. No password or authentication is required — the attacker simply needs network access. This is a denial-of-service flaw that can disrupt your home or office WiFi without leaving traditional evidence of intrusion.

• CVE-2026-43676MEDIUM 6.5

  An out-of-bounds memory access flaw in Apple's Safari browser and related operating systems can cause unexpected crashes when users visit websites containing malicious content. The vulnerability affects Safari on Mac, iPhone, and iPad, as well as visionOS and watchOS. While the issue results in denial of service rather than data theft or system compromise, it degrades user experience and could be chained with other exploits in targeted attacks. Apple has patched the vulnerability across its ecosystem.

• CVE-2026-43703MEDIUM 6.5

  CVE-2026-43703 is a memory handling flaw in Apple's operating systems that can cause an application to crash when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website or viewing attacker-controlled web content; the crash itself does not expose data or allow unauthorized access, but it does disrupt availability. Apple has patched this issue across iOS, iPadOS, macOS variants, tvOS, visionOS, and watchOS.

• CVE-2026-43712MEDIUM 6.5

  A memory handling flaw in Safari and related Apple platforms can cause a web browser to crash when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website, but no special access or user privileges are required beyond normal browsing. The issue affects Safari on macOS and iOS/iPadOS devices, as well as Apple TV, Vision Pro, and Watch.

• CVE-2026-43745MEDIUM 6.5

  Safari and related Apple products contain an out-of-bounds write vulnerability that can crash the browser when processing specially crafted web content. An attacker would need to trick a user into visiting a malicious website to trigger the flaw. There is no indication of data theft or system compromise, but the denial-of-service impact may disrupt work or enable follow-on attacks.

• CVE-2026-53701MEDIUM 6.5

  A flaw exists in GStreamer's H.266/VVC video codec parser that allows an attacker to write data beyond the boundaries of memory buffers. When processing specially crafted video files, the parser fails to properly validate loop boundaries while organizing video slices, potentially writing to unintended memory locations. This can cause the application to crash or behave unexpectedly. The vulnerability requires user interaction (opening or playing a malicious video file) but can be triggered remotely by distributing the crafted file.

• CVE-2026-53702MEDIUM 6.5

  A flaw in GStreamer's H.265 video codec parser allows a specially crafted video file to trigger a crash or memory corruption on systems that process it. The bug occurs when the parser mishandles internal buffer size calculations during video stream analysis, writing data beyond allocated memory on the stack. An attacker could distribute a malicious video file that crashes applications or services using this library, but direct code execution is not indicated by the vulnerability mechanics.

• CVE-2026-60094MEDIUM 6.5

  Vinchin Backup & Recovery versions through 9.0.0.86562 contain a vulnerability in their agentlink_server service that allows attackers to crash the backup agent or corrupt its memory without needing credentials. An attacker sends a specially crafted network packet with an incorrect length field that tricks the service into reading far more data than allocated, potentially writing up to 4 GB of attacker-controlled data into memory. This could lead to service failure or, in theory, code execution, though the current risk is primarily denial of service and data corruption.

• CVE-2026-9105MEDIUM 6.5

  A vulnerability in TP-Link TL-WR841N v14 routers allows anyone with valid login credentials to crash the device by sending specially crafted web requests. When triggered, the router's web server crashes and forces the device to automatically reboot, disrupting network connectivity until it comes back online. No data is at risk—this is purely a denial-of-service issue.

• CVE-2026-15105MEDIUM 6.3

  A memory corruption vulnerability exists in snap7, an open-source library for communicating with Siemens S7 PLCs, affecting versions up to 1.4.3. When processing certain ReadVar requests, the TS7Worker::PerformFunctionRead handler writes data beyond the bounds of an allocated buffer. An attacker with access to the local network can trigger this flaw to corrupt memory, potentially causing crashes or enabling code execution. The vulnerability is publicly exploitable; proof-of-concept code has been released and the vendor has not yet issued a patch or timeline for remediation.

• CVE-2026-5066MEDIUM 6.3

  A vulnerability exists in Zephyr's TLS socket implementation where attackers with network access and authenticated credentials can trigger an out-of-bounds memory access. When TLS session caching is enabled, the system copies network address data into a fixed buffer without checking if the caller-supplied size matches the actual buffer capacity. An attacker can specify an artificially large address size, causing the copy operation to overwrite adjacent memory. This can crash the system, disrupt network services, or potentially allow code execution if memory corruption is leveraged effectively.

• CVE-2026-5589MEDIUM 6.3

  A flaw in Zephyr's Bluetooth Mesh implementation allows a nearby attacker to send a malicious wireless advertisement that triggers memory corruption. The vulnerable code fails to validate that certain length values are reasonable before using them in calculations, leading to reads and writes far outside intended memory boundaries. Devices with Bluetooth Mesh enabled and the optional proxy server feature active are at risk. No authentication or pairing is required—an attacker simply broadcasts a specially crafted BLE packet.

• CVE-2026-53465MEDIUM 6.2

  ImageMagick, a widely-used image editing and manipulation tool, contains a memory corruption vulnerability in versions before 7.1.2-25. When processing specially crafted multi-frame images using the SF3 encoder, the software can write data beyond allocated memory boundaries, potentially causing application crashes or system instability. This is a local vulnerability requiring no special privileges or user interaction to trigger.

• CVE-2026-44663MEDIUM 6.1

  OpenEXR versions 3.4.0 through 3.4.11 contain a flaw in how they process HTJ2K-compressed EXR image files. When decoding a specially crafted file, an integer overflow occurs during calculation of image channel dimensions, resulting in an incorrect memory address. This address is then used to write data to the heap, potentially overwriting adjacent memory. An attacker could exploit this by distributing a malicious EXR file; a user opening it in affected software could experience a crash or, in principle, allow code execution, though the latter is not confirmed. The vulnerability has been patched in version 3.4.12.

• CVE-2026-58304MEDIUM 6.1

  Samsung's Escargot JavaScript engine contains a memory safety vulnerability that allows an attacker to read from or write to memory locations outside the intended buffer boundaries. An attacker with local access who tricks a user into opening a malicious file or visiting a compromised page can trigger the overflow, potentially crashing the application or modifying memory to achieve unintended behavior. This is not currently a known exploited vulnerability in the wild.

• CVE-2026-8916MEDIUM 6.1

  Samsung's rlottie library—an open-source animation renderer—contains a flaw that allows attackers to write data beyond the boundaries of allocated memory buffers. The vulnerability requires local access and user interaction (such as opening a crafted animation file), but once triggered, can corrupt memory and cause the application to crash or behave unpredictably. This is classified as a medium-severity issue because exploitation requires the victim to actively engage with untrusted animation content on their own system.

• CVE-2026-55577MEDIUM 5.9

  ImageMagick, a widely used open-source image manipulation library, contains a heap buffer overflow vulnerability in its MVG (Magick Vector Graphics) decoder. When processing specially crafted images, the decoder can write data beyond allocated memory boundaries, potentially causing the application to crash or become unstable. This flaw affects versions before 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-46690MEDIUM 5.8

  A memory safety vulnerability exists in unbounded_spsc versions 0.2.0 and earlier, a Rust library for lock-free message passing. The flaw occurs when the sender transmutes a pointer as a value and then sends it, which can cause the receiver to read memory outside the intended bounds or incorrectly drop a reference-counted object if the sender and receiver operate concurrently. This could lead to information disclosure or denial of service. No public patches are currently available.

• CVE-2026-14063MEDIUM 5.7

  CVE-2026-14063 is a memory disclosure vulnerability in Google Chrome's Chromecast component that allows a local attacker to read sensitive data from the browser process. The flaw requires the attacker to be on the same network and the user to interact with malicious network traffic, but does not require elevated privileges. While individual impact is modest, this type of information leak can enable reconnaissance for more sophisticated attacks. Google rated the underlying issue as low severity, but the combination of local network access, user interaction requirement, and memory disclosure capability warrants MEDIUM priority in most enterprise environments.

• CVE-2026-20456MEDIUM 5.5

  A flaw in MediaTek's wireless LAN driver allows an authenticated local user to crash the system without any user interaction. The vulnerability stems from missing boundary validation in the wlan STA (Station) driver code, permitting an attacker with user-level access to send crafted input that causes an out-of-bounds write. The impact is denial of service—the device becomes unresponsive until rebooted.

• CVE-2026-40257MEDIUM 5.5

  OP-TEE, a Trusted Execution Environment for ARM processors, contains a critical memory corruption bug in its SHA-3 cryptographic implementation when using ARM Crypto Extensions. The vulnerability stems from an off-by-one error in the SHA-3 accelerated code path that triggers a heap overflow, potentially corrupting the entire TEE kernel memory. This affects deployments running OP-TEE versions 3.21.0 through 4.10.x on ARMv8.2+ platforms with SHA3 Crypto Extensions enabled. Organizations must upgrade to version 4.11.0 or disable the affected acceleration feature.

• CVE-2026-46521MEDIUM 5.5

  ImageMagick, a widely-used open-source image manipulation library, contains a flaw in its LZMA compression handling within the MIFF encoder. When processing specially crafted image files, the software can write data beyond allocated memory boundaries, potentially crashing the application or corrupting system memory. This vulnerability affects versions prior to 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch).

• CVE-2026-48724MEDIUM 5.5

  ImageMagick versions before 7.1.2-24 contain a memory corruption flaw triggered when processing images that use a mask combined with the Floyd-Steinberg dithering algorithm. The vulnerability allows an attacker to overwrite heap memory in negative offsets, potentially causing the application to crash. An attacker would need to trick a user into opening a specially crafted image file, making this a local attack that depends on user interaction.

• CVE-2026-55597MEDIUM 5.5

  ImageMagick, widely used for image processing tasks, contains a heap buffer overflow vulnerability in its JP2 (JPEG 2000) encoder. When processing specially crafted image files, the software can write data beyond allocated memory boundaries due to improper argument handling. While the vulnerability requires user interaction—someone must open a malicious image—the outcome is a denial of service. The issue affects ImageMagick versions prior to 7.1.2-26 and has been patched in that release.

• CVE-2026-55892MEDIUM 5.5

  Vim versions before 9.2.0662 contain a stack buffer overflow vulnerability in the spell-checking module. When a user loads a maliciously crafted spell file (.spl) and dumps the word list, the editor can crash. The vulnerability exists because the code that walks through spell-file data structures doesn't validate how deep it descends before writing to fixed-size memory buffers, allowing an attacker to trigger a crash by crafting a spell file with excessive nesting.

• CVE-2026-59857MEDIUM 5.5

  Vim, the widely-used command-line text editor, contains a buffer overflow vulnerability in its spell-checking feature. When Vim processes spell-file rules to suggest corrections for misspelled words, a crafted word of exactly the right length can cause the editor to write one byte past the end of an internal buffer. This corrupts Vim's memory, typically crashing the editor. The vulnerability only affects spell-checking in single-byte (non-Unicode) encodings and requires user interaction—opening a file or triggering spell suggestions on a malicious word. An attacker cannot remotely exploit this or gain code execution; the impact is denial of service through editor crashes.

• CVE-2026-12298MEDIUM 5.4

  A memory safety vulnerability was discovered in Mozilla Firefox and Thunderbird that allows an attacker to read or modify memory during user interaction with a malicious website or email. The flaw does not enable remote code execution or denial of service, but could leak sensitive information or corrupt application state. Mozilla has released patched versions to address this issue.

• CVE-2026-12528MEDIUM 5.4

  A bug in 389 Directory Server's ACI (Access Control Instruction) parsing can allow an authenticated user to corrupt memory on the server. When a specially crafted ACI string is processed, the parser fails to properly validate keyword length after removing whitespace, causing it to write one byte beyond allocated heap memory and then read from invalid locations. An attacker with write permissions to the aci attribute could exploit this to silently damage the server's memory state, potentially leading to service degradation or unexpected behavior.

• CVE-2026-20461MEDIUM 5.3

  A memory safety vulnerability exists in modem firmware that allows an attacker to crash the device remotely. By setting up a rogue base station, an attacker can trigger an out-of-bounds memory write that denial-of-services any connected device. No special privileges or user interaction are required—the attack succeeds simply by a user connecting to the malicious base station. The severity is moderate because exploitation requires proximity (the attacker must operate a base station) and doesn't grant further system access or data exposure.

• CVE-2026-21368MEDIUM 5.3

  A memory corruption flaw exists in how Qualcomm processors and connectivity modules parse JPEG commands. During validation checks, the code writes extra data to a buffer beyond what is accounted for, potentially corrupting memory. An attacker with local access and user-level privileges can exploit this to read sensitive data, modify system behavior, or cause a crash. The vulnerability affects a broad range of Qualcomm chipsets used in smartphones, AR/XR devices, and networking hardware.

• CVE-2026-21369MEDIUM 5.3

  A memory corruption vulnerability exists in Qualcomm firmware and chipsets that control LED indicators on wireless and audio devices. The flaw occurs when an application modifies LED count values in memory, but the firmware continues using stale (outdated) count information when processing flash commands. This mismatch can cause the firmware to write data to incorrect memory locations, potentially corrupting device state or enabling further attacks. The vulnerability requires local access and moderately difficult conditions to exploit, but affects a broad range of Qualcomm connectivity and audio chipsets used in mobile devices, routers, and accessories.

• CVE-2026-21370MEDIUM 5.3

  Qualcomm Wi-Fi and cellular chipset firmware contains a memory corruption vulnerability that can be triggered when input validation fails to properly check batch size and buffer plane count parameters. An attacker with local access and low privileges can exploit this flaw to read or write memory, potentially affecting system stability or confidentiality. The vulnerability affects dozens of Qualcomm chipsets across FastConnect, G3X, IQ, and QCA product lines.

• CVE-2026-21384MEDIUM 5.3

  A memory corruption vulnerability exists in multiple Qualcomm wireless and connectivity chipsets when processing prepared commands with incorrect port index values supplied by local users. The flaw allows a user with local system access to trigger out-of-bounds memory writes, potentially compromising system confidentiality, integrity, and availability. This is a medium-severity local attack that requires specific knowledge of the affected firmware interfaces and cannot be exploited remotely.

• CVE-2026-56114MEDIUM 5.3

  dhcpcd, a widely-used DHCP client for Unix-like systems, contains a stack memory vulnerability that can be triggered by an attacker on the same network segment. An attacker can send a specially crafted DHCPv6 advertisement message that causes dhcpcd to write one byte past the boundary of an internal buffer. While this is a limited write (one byte), it occurs on the stack and can corrupt adjacent memory structures, potentially leading to a denial of service. The vulnerability affects dhcpcd versions up to 10.3.2 and has been fixed in a subsequent commit.

• CVE-2026-57021MEDIUM 5.3

  Juniper Networks Junos OS on SRX Series devices contain a memory handling flaw in their web management component that allows remote attackers to knock the system offline. If your SRX is configured to perform security checks before users log in to the VPN, an attacker can send specially crafted network traffic that crashes the web service, taking down VPN access, J-Web management, and firewall authentication until the service restarts on its own. No authentication or user interaction is needed to trigger this problem.