tag
Heap-Corruption
Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)
CVE-2025-54957 is a critical out-of-bounds write vulnerability in Dolby's DDPlus Unified Decoder, triggered while processing "evolution" data in an AC-3/EC-3 (Dolby Digital Plus) bitstream. An integer overflow in the length calculation for evolution-data…
Tasmota fetch_jpg() Integer Wraparound to Heap Corruption (CVE-2026-38427)
When fetching subsequent MJPEG frames (case 2) in Tasmota's scripter driver, fetchjpg() reads the Content-Length header value via atoi() into a uint16t variable. Values above 65535 silently wrap around (e.g. 65537 becomes 1), causing the device to allocate a…
OP-TEE PKCS#11 TA Out-of-Bounds Heap Write via `C_GetAttributeValue` (CVE-2026-33317)
CVE-2026-33317 is missing bounds validation in entrygetattributevalue() in the OP-TEE PKCS#11 Trusted Application, reachable via the PKCS11CMDGETATTRIBUTEVALUE command. The TA does not verify that each attribute header and its associated data region lie fully…
Redis Vector Set Duplicate HNSW Node ID RCE
Redis Vector Set RDB/RESTORE deserialization accepts serialized HNSW graph nodes that reuse the same node ID, but the ID-lookup table only tracks one node per ID while the element dictionary tracks nodes by name, so link validation ends up trusting IDs…
c-ares TCP ares_getaddrinfo() Use-After-Free Code Execution
c-ares's aresgetaddrinfo() path over DNS-over-TCP with EDNS enabled contains a use-after-free reachable when a malicious or compromised DNS server sends two responses for the same query ID in a single TCP read — the first a FORMERR without OPT data…
libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)
CVE-2026-55200 is a critical heap out-of-bounds write in libssh2's SSH transport layer (ssh2transportread() in src/transport.c). The function validates that packetlength is greater than zero but performs no upper-bound check, allowing an attacker-controlled…
FFmpeg MagicYUV Decoder Out-of-Bounds Write / RCE — PixelSmash (CVE-2026-8461)
CVE-2026-8461 (codename PixelSmash) is a High-severity out-of-bounds heap write in FFmpeg's MagicYUV decoder (libavcodec). Improper bounds validation during frame decoding allows a specially crafted video file with an odd slice height to trigger a heap buffer…
Windows Kernel Elevation of Privilege - Race Condition / Double-Free (CVE-2025-62215)
CVE-2025-62215 is a Windows Kernel Elevation of Privilege vulnerability disclosed and patched in November 2025, confirmed to have been actively exploited as a zero-day in the wild prior to patching. The bug combines a race condition in kernel resource…
Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918
CVE-2026-23918 is a pre-authentication double-free vulnerability in Apache httpd's modhttp2 stream cleanup path. Under affected configurations, a remote attacker can trigger memory corruption over HTTP/2 before authentication. The upstream PoC demonstrates…