Oob-Write — PoC Archivehttps://poc.intelseclab.com/tags/oob-write/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000PHP bcmath bccomp() Out-of-Bounds Write (CVE-2026-17544)https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-17544-php-bcmath-oob-write/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-17544-php-bcmath-oob-write/Critical severity (CVSS 9.8) — web · CVE-2026-17544 / GHSA-x692-q9x7-8c3f. Status: Patched (PHP 8.4.24 / 8.5.9). Affects: PHP (ext/bcmath). Tags: php, bcmath, oob-write, stack-smashing, rce, cwe-787, CVE-2026-17544.webCriticalphpbcmathoob-writestack-smashingrcecwe-787CVE-2026-17544OP-TEE PKCS#11 TA Out-of-Bounds Heap Write via `C_GetAttributeValue` (CVE-2026-33317)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-33317-optee-pkcs11-heap-oob-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-33317-optee-pkcs11-heap-oob-write/High severity (CVSS 8.7) — binary · CVE-2026-33317 (GHSA-8cqw-mg7v-c9p9). Status: PoC. Affects: OP-TEE OS — PKCS#11 Trusted Application (optee_os, ta/pkcs11). Tags: optee, trustzone, pkcs11, secure-world, heap-corruption, oob-write, qemu, trusted-application.binaryHighopteetrustzonepkcs11secure-worldheap-corruptionoob-writeqemutrusted-applicationLinux FUSE Readdir Cache Out-of-Bounds Write to Root LPE — CVE-2026-31694https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/High severity — binary · CVE-2026-31694. Status: Weaponized. Affects: Linux kernel — fs/fuse/readdir.c (fuse_add_dirent_to_cache()). Tags: linux-kernel, fuse, oob-write, page-cache, lpe, groom, unprivileged, qemu-kvm.binaryHighlinux-kernelfuseoob-writepage-cachelpegroomunprivilegedqemu-kvmPillow ImageCms Mutable output_mode Heap OOB Writehttps://poc.intelseclab.com/pocs/binary/2026-07-03_pillow-imagecms-output-mode-oob-write/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_pillow-imagecms-output-mode-oob-write/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: Pillow (Python Imaging Library fork), PIL.ImageCms module. Tags: pillow, imagecms, littlecms, heap-overflow, oob-write, python, image-processing, memory-corruption.binaryHighpillowimagecmslittlecmsheap-overflowoob-writepythonimage-processingmemory-corruptionFFmpeg RASC Decoder DLTA Heap Out-of-Bounds Writehttps://poc.intelseclab.com/pocs/binary/2026-07-03_ffmpeg-rasc-dlta-heap-oob-write/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_ffmpeg-rasc-dlta-heap-oob-write/Critical severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: FFmpeg, libavcodec RASC decoder (AV_CODEC_ID_RASC). Tags: ffmpeg, libavcodec, heap-overflow, rasc, oob-write, media-parsing, codec, memory-corruption.binaryCriticalffmpeglibavcodecheap-overflowrascoob-writemedia-parsingcodecmemory-corruptionlibssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Critical severity (CVSS 9.8) — network · CVE-2026-55200. Status: PoC. Affects: libssh2 (SSH client library). Tags: RCE, OOB-write, heap-corruption, libssh2, SSH, integer-overflow, unauthenticated, C, network.networkCriticalRCEOOB-writeheap-corruptionlibssh2SSHinteger-overflowunauthenticatedCnetworkFFmpeg MagicYUV Decoder Out-of-Bounds Write / RCE — PixelSmash (CVE-2026-8461)https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-8461-ffmpeg-magicyuv-oob-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-8461-ffmpeg-magicyuv-oob-rce/High severity (CVSS 8.8) — binary · CVE-2026-8461. Status: PoC. Affects: FFmpeg libavcodec — MagicYUV video decoder. Tags: RCE, OOB-write, heap-corruption, FFmpeg, MagicYUV, media, video, PixelSmash, libavcodec, Python, High.binaryHighRCEOOB-writeheap-corruptionFFmpegMagicYUVmediavideoPixelSmashlibavcodecPythonHighQEMUtiny - QEMU CXL Type-3 Memory Corruption Chainhttps://poc.intelseclab.com/pocs/binary/2026-05-16_qemutiny-memory-corruption/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-16_qemutiny-memory-corruption/Critical severity — binary. Status: Weaponized. Affects: QEMU CXL Type-3 device emulation (hw/cxl/cxl-mailbox-utils.c). Tags: QEMU, CXL, memory-corruption, OOB-read, OOB-write, guest-to-host-escape, local, root-in-guest.binaryCriticalQEMUCXLmemory-corruptionOOB-readOOB-writeguest-to-host-escapelocalroot-in-guest