Memory corruption.

libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption

• libyal libvmdk
• Memory corruption

NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg

• networkupstools nut
• Memory corruption

Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

• Memory corruption
• CWE-252

<1.2.7 · fixed in 1.2.7

FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

• pavel-odintsov fastnetmon
• Memory corruption

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

• pavel-odintsov fastnetmon
• Memory corruption

FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

• pavel-odintsov fastnetmon
• Memory corruption

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

• pavel-odintsov fastnetmon
• Memory corruption

FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames

• pavel-odintsov fastnetmon
• Memory corruption

Heap buffer overflow in dBASE index import

• The Document Foundation LibreOffice
• Denial of service
• Memory corruption

FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling

• signalwire freeswitch
• Memory corruption

FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data

• signalwire freeswitch
• Memory corruption
• CWE-129

FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing

• signalwire freeswitch
• Memory corruption
• Information disclosure

FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing

• signalwire freeswitch
• Memory corruption
• CWE-193

FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

• signalwire freeswitch
• Memory corruption
• CWE-681

FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length

• signalwire freeswitch
• Memory corruption
• Denial of service

FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header construction

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing

• signalwire freeswitch
• Memory corruption

FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls

• signalwire freeswitch
• Memory corruption

FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences

• signalwire freeswitch
• Memory corruption
• CWE-193

FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user

• signalwire freeswitch
• Memory corruption

accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql

• accel-ppp
• Memory corruption

NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

• NEURON
• Memory corruption

libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name

• bakulf libnxml
• Memory corruption

eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute

• book-readers eBook-speaker
• Memory corruption

Stack-based buffer overflow in SafeNet Authentication Client SIS token engine

• Thalesgroup Safenet Authentication Client SIS token engine
• Memory corruption
• CWE-1284

WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

• bytecodealliance wasm-micro-runtime
• Memory corruption

WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

• bytecodealliance wasm-micro-runtime
• Memory corruption

WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

• bytecodealliance wasm-micro-runtime
• Memory corruption

Local privilege escalation in SafeNet Authentication Client SACSrv

• Thalesgroup Safenet Authentication Client Service
• Memory corruption

ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

• esa asn1scc
• Memory corruption

ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

• esa asn1scc
• Memory corruption
• CWE-129

ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)

• esa asn1scc
• Memory corruption
• CWE-129

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets

• ntopng
• Memory corruption

stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file

• leejet stable-diffusion.cpp
• Memory corruption

stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name

• leejet stable-diffusion.cpp
• Memory corruption
• CWE-1284

Integer overflow in musl

• musl
• Memory corruption

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder

• libsdl-org SDL_mixer
• Memory corruption

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

• libsdl-org SDL_mixer
• Memory corruption

OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds

• OpenPPL ppl.nn
• Memory corruption

Buffer overflow in Samsung Semiconductor Exynos 850 and others

• Samsung Semiconductor Exynos 850
• Samsung Semiconductor Exynos 2100
• Memory corruption

NULL pointer dereference in Samsung Semiconductor Exynos 1280 and others

• Samsung Semiconductor Exynos 1280
• Samsung Semiconductor Exynos 2200
• Memory corruption

Out-of-bounds write in Samsung Semiconductor Exynos 1280 and others

• Samsung Semiconductor Exynos 1280
• Samsung Semiconductor Exynos 2200
• Memory corruption

Double free in Samsung Semiconductor Exynos 1480 and others

• Samsung Semiconductor Exynos 1480
• Samsung Semiconductor Exynos 2400
• Memory corruption

Double free in Samsung Semiconductor Exynos 1480 and others

• Samsung Semiconductor Exynos 1480
• Samsung Semiconductor Exynos 2400
• Memory corruption

Integer overflow in Samsung Semiconductor Exynos 2100 and others

• Samsung Semiconductor Exynos 2100
• Samsung Semiconductor Exynos 1280
• Memory corruption

Integer overflow in Samsung Semiconductor Exynos 1480 and others

• Samsung Semiconductor Exynos 1480
• Samsung Semiconductor Exynos 2400
• Memory corruption

Out-of-bounds write in Samsung Semiconductor Exynos 1280 and others

• Samsung Semiconductor Exynos 1280
• Samsung Semiconductor Exynos 2200
• Memory corruption

Out-of-bounds write in Samsung Semiconductor Exynos Modem 5300 and others

• Samsung Semiconductor Exynos Modem 5300
• Samsung Semiconductor Exynos Modem 5400
• Memory corruption

NULL pointer dereference in Samsung Semiconductor Exynos 1480 and others

• Samsung Semiconductor Exynos 1480
• Samsung Semiconductor Exynos 2400
• Memory corruption