tag
Integer-Overflow
Windows Message Queuing (MSMQ) Queue Manager Heap-Based Buffer Overflow (CVE-2026-54992)
MSMQ's Queue Manager processes RStartReceive/RStartTransactionalReceive responses from the MS-MQRR RPC interface as a set of SectionBuffer structures, each carrying its own SectionSizeAlloc. When a remote-read response is split into multiple sections,…
Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)
CVE-2025-54957 is a critical out-of-bounds write vulnerability in Dolby's DDPlus Unified Decoder, triggered while processing "evolution" data in an AC-3/EC-3 (Dolby Digital Plus) bitstream. An integer overflow in the length calculation for evolution-data…
Windows HTTP.sys Header-Count-Triggered Kernel Memory Corruption / BSOD (CVE-2026-49160)
This PoC targets a memory-safety bug in the Windows HTTP.sys kernel driver's request header parsing path (HTTP!UlpParseNextRequest / HTTP!UlpHandleRequest). The included http2bomb.py script establishes a TLS/HTTP2 connection to a target IIS/HTTP.sys-backed…
VirtualBox DevVGA_VBVA Integer Overflow leading to Guest-Triggerable DoS (CVE-2026-35250)
VirtualBox's DevVGAVBVA.cpp dimension-validation check uses a logical OR where an AND is required, letting a malicious guest supply width=0x80000001, height=16 and pass the bounds check. The resulting pointer-data size calculation (cbPointerData) then…
Tasmota fetch_jpg() Integer Wraparound to Heap Corruption (CVE-2026-38427)
When fetching subsequent MJPEG frames (case 2) in Tasmota's scripter driver, fetchjpg() reads the Content-Length header value via atoi() into a uint16t variable. Values above 65535 silently wrap around (e.g. 65537 becomes 1), causing the device to allocate a…
Tasmota fetch_jpg() Combined Buffer Overflow RCE Chain (CVE-2026-38422)
Tasmota's scripter driver (xdrv10scripter.ino) implements an MJPEG client via fetchjpg() that contains two compounding memory-corruption bugs: a strcpy() overflow of a fixed 40-byte boundary[] buffer when parsing the Content-Type boundary string…
PgBouncer SASL Length Field Integer Overflow Crash — CVE-2026-6664
PgBouncer's mbufgetbytes() bounds check (lib/usual/mbuf.h) computes buf->readpos + len > buf->writepos using 32-bit unsigned arithmetic, which wraps around when a client supplies a very large length value in a SASLInitialResponse ('p') message, silently…
libssh2 Unchecked SSH packet_length Integer Wrap to RCE (CVE-2026-55200)
CVE-2026-55200 is an unchecked packetlength condition in libssh2's ssh2transportread() transport-parsing path. The vulnerable code accepts an attacker-controlled decrypted SSH packetlength field and only rejects values less than 1, then computes an allocation…
libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution
libssh2publickeylistfetch() parses a stream of publickey-subsystem response packets and grows an array of libssh2publickeylist entries as responses arrive, but the parser has two distinct memory-safety defects depending on target architecture. On 32-bit…
libarchive ZIP Declared-Size Boundary Bypass via debuginfod
The PoC builds a stored ZIP64 archive entry whose declared uncompressed size field is 109 bytes while the actual inflated stream is 4 GiB + 109 bytes — crafted so the low 32 bits of the true length equal the advertised value (0x100000004 mod 2^32 == 4, offset…
libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)
CVE-2026-55200 is a critical heap out-of-bounds write in libssh2's SSH transport layer (ssh2transportread() in src/transport.c). The function validates that packetlength is greater than zero but performs no upper-bound check, allowing an attacker-controlled…