tag
Buffer-Overflow
Ivanti Connect Secure / Policy Secure / ZTA Gateways Remote Unauthenticated Stack-Based Buffer Overflow (CVE-2025-22457)
CVE-2025-22457 is a remote, pre-authentication stack-based buffer overflow (CWE-121) in the HTTPS request-handling path of Ivanti Connect Secure and sibling appliances. A single oversized X-Forwarded-For request header overflows a fixed-size stack buffer in…
Tenda HG7/HG9/HG10 Router Stack-Based Buffer Overflow — CVE-2026-11499
CVE-2026-11499 is a stack-based buffer overflow (CWE-121) in the web-management formDOMAINBLK handler of Tenda HG7/HG9/HG10 router firmware. The vulnerable code path copies the attacker-supplied blkDomain form parameter into a fixed-size stack buffer without…
Tasmota fetch_jpg() strcpy() Buffer Overflow in boundary[40] (CVE-2026-38426)
The fetchjpg() function's initial-connection handling (case 0) in Tasmota's scripter driver extracts the MJPEG multipart boundary string from the HTTP Content-Type response header and copies it into a fixed 40-byte boundary[40] field of the JPGTASK struct…
Tasmota fetch_jpg() Combined Buffer Overflow RCE Chain (CVE-2026-38422)
Tasmota's scripter driver (xdrv10scripter.ino) implements an MJPEG client via fetchjpg() that contains two compounding memory-corruption bugs: a strcpy() overflow of a fixed 40-byte boundary[] buffer when parsing the Content-Type boundary string…
PX4 Autopilot MAVLink FTP Stack Buffer Overflow (CVE-2026-32743)
PX4 Autopilot's MAVLink FTP log-handling code (MavlinkLogHandler / MAVLink FTP directory listing path) copies an attacker-supplied directory path into a fixed-size stack buffer without validating its length. Sending a MAVLink FTP request (e.g. via…
PJSIP / PJNATH ICE Session Stack Buffer Overflow via SDP ice-ufrag (CVE-2026-25994)
CVE-2026-25994 is a stack-based buffer overflow in PJNATH's ICE (Interactive Connectivity Establishment) session handling, specifically in pjicesesscreatechecklist() in pjnath/src/pjnath/icesession.c. When constructing the ICE username, the code copies the…
GNU InetUtils telnetd LINEMODE SLC Pre-Auth Buffer Overflow (CVE-2026-32746)
GNU InetUtils telnetd's addslc() function in telnetd/slc.c appends 3 bytes per SLC (Set Local Characters) triplet into a fixed 108-byte buffer (slcbuf) with no bounds checking. During telnet option negotiation, before any login prompt is shown, an…
dnsmasq extract_addresses() RDLEN/RDATA Buffer Overflow — CVE-2026-5172
The PoC targets extractaddresses() in dnsmasq, which parses resource records (RRs) returned by an upstream DNS server. The function is reported to trust the RR's declared RDLENGTH field without properly validating it against the actual RDATA bytes present in…
GeoVision GV-I/O Box 4E DVRSearch Unauthenticated Stack Buffer Overflow RCE (CVE-2026-12485)
CVE-2026-12485 is a CVSS 10.0 unauthenticated stack-based buffer overflow in the GeoVision GV-I/O Box 4E, a Linux-based smart I/O device used in physical security and building automation. The DVRSearch service listens on UDP port 10001 and handles CMDIPSET…
Ivanti Connect Secure Pre-Auth RCE (Stack Overflow)
CVE-2025-0282 is a pre-authentication stack-based buffer overflow in the IFT (IF-T) TLS protocol handling code of Ivanti Connect Secure VPN appliances. Discovered and disclosed by Sina Kheirkhah of watchTowr Labs, this zero-day was confirmed by Mandiant as…
NGINX Rift — Heap Buffer Overflow RCE (CVE-2026-42945)
CVE-2026-42945 is a critical heap buffer overflow in NGINX's ngxhttprewritemodule that has existed since 2008. When a server configuration combines a rewrite rule containing ? with a set directive, NGINX's two-pass script engine allocates an undersized buffer…