Socket versions before 2.041 for Perl have an out-of-bounds heap read.
Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling…
—
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap me
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.
· ffmpeg ffmpeg—
KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculat
KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.
—
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite r
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.
· ffmpeg ffmpeg—
KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit.
KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.
—
Origin Validation Error in Microsoft .NET Enables Cross-Origin Information Disclosure
CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.
· Microsoft .NETmass
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
· php php—
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match…
—
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* befo
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
· php php—
Perl regex engine flaw yields incorrect match results via stale failure flag
Perl versions from 5.9.4 before 5.41.9 can produce incorrect regular-expression match results because a stale failure flag in the Aho-Corasick prescan (S_find_byclass) is not cleared when a later transition succeeds, causing the prescan to stop before it records an earlier valid match position. The flaw is triggered by alternation patterns where one candidate position is recorded and a later character then forces a fallback through a fail link that succeeds; for example, 'ABCDE' =~ m/ABCF|BCDE|C/ matches C at offset 2 instead of BCDE, and m/ABCF|BCDE|C(G/) fails to match at all. An attacker who controls input to such a regex can make an access-control, validation, or filtering decision resolve incorrectly, either matching the wrong alternative branch or missing a match entirely, with impact rated low (CVSS 5.3, medium). Any application running an affected Perl interpreter whose security-relevant regexes use alternations is exposed, and because Perl ships by default with virtually all Linux and Unix systems the installed base is enormous even though only specific pattern shapes trigger the bug. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.4%, so no exploitation is currently known.
· Perl >= 5.9.4 and < 5.41.9 (fixed in 5.41.9) · Ubuntu perl (distribution packages)mass