tag
Heap-Overflow
nginx PCRE Capture Variable Heap Overflow to Pre-Auth RCE (CVE-2026-42533)
CVE-2026-42533 is a heap buffer overflow in nginx triggered by PCRE regex capture variable handling. When two map directives share the same capture group name, a length/value mismatch occurs in the internal variable copy code (ngxhttpscriptcopycapturecode and…
Citrix NetScaler ADC/Gateway -- Pre-Auth SAML PrefixList Heap Overflow to RCE (CVE-2026-8452)
CVE-2026-8452 is a pre-authentication heap buffer overflow in the Citrix NetScaler ADC and Gateway SAML authentication handler. The vulnerability exists in the XML Signature Canonicalization (C14N) processing of the PrefixList attribute within SAML responses.…
Windows Message Queuing (MSMQ) Queue Manager Heap-Based Buffer Overflow (CVE-2026-54992)
MSMQ's Queue Manager processes RStartReceive/RStartTransactionalReceive responses from the MS-MQRR RPC interface as a set of SectionBuffer structures, each carrying its own SectionSizeAlloc. When a remote-read response is split into multiple sections,…
XNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)
XNU's routing socket implementation processes RTMGET messages carrying an RTAGENMASK sockaddr through rnaddmask(), which copies the supplied genmask into a fixed, address-family-dependent radix-tree node buffer without validating that the attacker-controlled…
Wyze Cam Pan v3 / TUTK SDK — tutk_packet_alloc Heap Overflow (CVE-2026-38698)
The tutkpacketalloc function inside the TUTK SDK's tutkavserver component, used by Wyze Cam Pan v3 and other TUTK-integrated IoT cameras, allocates a buffer for incoming AV packets based on an attacker-influenced size field without adequate bounds validation.…
rldns 1.3 Heap-Based Out-of-Bounds Read Remote DoS (CVE-2026-27831)
rldns is an open-source DNS server for Linux, FreeBSD, and NetBSD. Version 1.3 contains a heap-based out-of-bounds read that can be triggered remotely by sending a specially crafted, malformed DNS-like UDP packet, causing the server process to crash and…
PostgreSQL pgcrypto PGP Heap Overflow to Superuser Escalation — CVE-2026-2005
The pgcrypto extension's PGP session-key parsing contains a heap-based buffer overflow that corrupts MBuf structure headers used internally to track ciphertext/plaintext buffers. By crafting malicious PGP messages passed to pgcrypto decryption functions, a…
Ollama GGUF Heap Out-of-Bounds Read During Quantization — CVE-2026-7482
Ollama versions prior to 0.17.1 do not validate that a GGUF model file's declared tensor size matches the actual bytes present in the file. By crafting a GGUF file whose tensor metadata declares a much larger shape than the data actually written, and then…
Nginx QUIC/HTTP-3 DCID Length Heap Overflow Lab (CVE-2026-0211)
This repository is a university penetration-testing course project that models a hypothetical heap buffer overflow in Nginx's QUIC (HTTP/3) packet parser, where the Destination Connection ID (DCID) length field is not properly bounds-checked before being used…
nginx PoolSlip × Rift Chained ASLR-Independent Remote Code Execution (CVE-2026-9256 / CVE-2026-42945)
This PoC chains two nginx rewrite-engine bugs that share the same root cause — a two-pass mismatch in how isargs/$args length is computed — into a single ASLR-independent remote system() call on a stock, unmodified nginx:1.30.0 Docker image, with no hardcoded…
MariaDB JSON_SCHEMA_VALID() Heap Overflow — Privilege Escalation to UDF RCE (CVE-2026-32710)
MariaDB's jsongetnormalizedstring() (used by JSONSCHEMAVALID(), sql/jsonschemahelper.cc:91) performs an unbounded strncpy of up to 192 bytes into a 128-byte DYNAMICSTRING buffer, producing a heap out-of-bounds write. The included exploit chains this overflow…
libopenapv / Android APV Codec Zero-Click Heap Buffer Overflow (CVE-2026-0006)
The APV decoder in libopenapv parses two different structures — an AUINFO PBU (Payload Byte Unit) and the actual FRAME PBU — to determine frame dimensions, but oapvdinfo() and oapvddecode() read those dimensions from different sources without cross-validating…
gdk-pixbuf JPEG Loader Heap Buffer Overflow — CVE-2026-5201
gdk-pixbuf's direct JPEG loading path (gdkpixbufjpegimageload / gdkpixbufrealjpegimageload in io-jpeg.c) allocates the output pixel buffer based on the expected number of color components (3 for RGB, 4 for CMYK) without validating that libjpeg's actual…
VLC Bundled FFmpeg VP9 Decoder Resolution-Change Heap Crash
VLC 3.0.23's bundled FFmpeg VP9 decoder tracks per-frame slice-thread progress in an entries array sized from the superblock row count (sbrows) of the current frame. A crafted two-frame VP9 IVF file — a 64x64 first frame followed by a 64x8192 second frame…
Pillow ImageCms Mutable output_mode Heap OOB Write
Pillow's ImageCms.buildTransform() creates a reusable LittleCMS-backed transform object and stores mutable inputmode/outputmode attributes on the Python wrapper. ImageCmsTransform.apply() trusts these mutable attributes both to validate image modes and to…
libssh2 Unchecked SSH packet_length Integer Wrap to RCE (CVE-2026-55200)
CVE-2026-55200 is an unchecked packetlength condition in libssh2's ssh2transportread() transport-parsing path. The vulnerable code accepts an attacker-controlled decrypted SSH packetlength field and only rejects values less than 1, then computes an allocation…
libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution
libssh2publickeylistfetch() parses a stream of publickey-subsystem response packets and grows an array of libssh2publickeylist entries as responses arrive, but the parser has two distinct memory-safety defects depending on target architecture. On 32-bit…
FFmpeg RASC Decoder DLTA Heap Out-of-Bounds Write
FFmpeg's RASC decoder (decodedlta() in libavcodec/rasc.c) tracks a row cursor and only checks whether it has reached the end of the current row after certain operations, rather than before. Several DLTA run types (4, 7, 12, 13) perform 32-bit reads/writes at…
Squidbleed — Squid Proxy FTP Gateway Out-of-Bounds Heap Read (CVE-2026-47729)
CVE-2026-47729, dubbed "Squidbleed," is an out-of-bounds heap read in Squid Proxy's FTP gateway and FTP directory-listing parser. The bug stems from legacy FTP parsing logic (originally written in 1997 for NetWare-style listings) in FtpGateway.cc, where…
VMware vCenter Server DCE/RPC Heap Overflow RCE (CVE-2024-37079)
CVE-2024-37079 is a critical heap overflow condition in a vCenter Server DCE/RPC network-handling path. A crafted network packet can trigger memory corruption pre-authentication and potentially lead to remote code execution. Public reporting indicates patch…
NGINX Rift — Heap Buffer Overflow RCE (CVE-2026-42945)
CVE-2026-42945 is a critical heap buffer overflow in NGINX's ngxhttprewritemodule that has existed since 2008. When a server configuration combines a rewrite rule containing ? with a set directive, NGINX's two-pass script engine allocates an undersized buffer…