tag
Stack-Overflow
Ivanti Connect Secure / Policy Secure / ZTA Gateways Remote Unauthenticated Stack-Based Buffer Overflow (CVE-2025-22457)
CVE-2025-22457 is a remote, pre-authentication stack-based buffer overflow (CWE-121) in the HTTPS request-handling path of Ivanti Connect Secure and sibling appliances. A single oversized X-Forwarded-For request header overflows a fixed-size stack buffer in…
TanStack Query — Unbounded Recursion Denial of Service in `replaceEqualDeep` (CVE-2026-26903)
TanStack Query's internal replaceEqualDeep function recursively performs deep-equality comparisons between old and new query cache data so that unchanged object references can be preserved across re-renders. The recursive implementation has no depth limit or…
PJSIP / PJNATH ICE Session Stack Buffer Overflow via SDP ice-ufrag (CVE-2026-25994)
CVE-2026-25994 is a stack-based buffer overflow in PJNATH's ICE (Interactive Connectivity Establishment) session handling, specifically in pjicesesscreatechecklist() in pjnath/src/pjnath/icesession.c. When constructing the ICE username, the code copies the…
lwIP SNMPv3 USM Stack-Based Buffer Overflow (CVE-2026-8836)
lwIP's SNMPv3 User-based Security Model (USM) handler contains a stack-based buffer overflow in snmpparseinboundframe(). A commented-out bounds check combined with an incorrect buffer-size parameter passed to snmpasn1decraw() allows an oversized…
FreeBSD setcred(2) Kernel Stack Buffer Overflow — Local Privilege Escalation (CVE-2026-45250)
kernsetcredcopyinsuppgroups() in sys/kern/kernprot.c uses sizeof(groups) where groups is declared as gidt , so the size expression evaluates to 8 bytes (pointer size) instead of the intended 4 bytes (sizeof(gidt)). When the supplementary-groups count is small…
GeoVision GV-I/O Box 4E DVRSearch Unauthenticated Stack Buffer Overflow RCE (CVE-2026-12485)
CVE-2026-12485 is a CVSS 10.0 unauthenticated stack-based buffer overflow in the GeoVision GV-I/O Box 4E, a Linux-based smart I/O device used in physical security and building automation. The DVRSearch service listens on UDP port 10001 and handles CMDIPSET…
Netlogon CLDAP Stack Buffer Overflow (CVE-2026-41089)
This PoC targets CVE-2026-41089, a stack-based buffer overflow in the Windows Netlogon CLDAP handling path. A crafted UDP/389 CLDAP ping containing an oversized User value can overrun a stack buffer in the LSASS/Netlogon flow and crash the domain controller.…
Ivanti Connect Secure Pre-Auth RCE (Stack Overflow)
CVE-2025-0282 is a pre-authentication stack-based buffer overflow in the IFT (IF-T) TLS protocol handling code of Ivanti Connect Secure VPN appliances. Discovered and disclosed by Sina Kheirkhah of watchTowr Labs, this zero-day was confirmed by Mandiant as…