Search: “e2b”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Model release 3 AI tools & infra 3 AI safety & security 1 Vulnerability 1

SeverityAll critical 0 high 0 medium 2 low 0 info 6

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

openbmb/MiniCPM5-2B — new model trending #4 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B open-weights Transformer claiming 2B-class open-source SOTA for on-device deployment.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, and it is trending #4 on Hugging Face. The dense 2B Transformer targets on-device, local, and resource-constrained deployment and claims 2B-class open-source SOTA while remaining competitive with 4B-class models. Reported strengths include coding, mathematics, long-context understanding, tool use, and agentic tasks; a tech report (arXiv 2506.07900), GitHub repo, and online demo accompany the release.

Hugging Face trending modelsSep 6, 11:12 UTC · 10d agoModel release

openbmb/MiniCPM5-2B-GGUF — new model trending #30 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B on-device model claiming open-source SOTA among 2B-class models.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, as a dense 2B Transformer built for on-device and resource-constrained deployment with GGUF weights on Hugging Face. The team claims 2B-class open-source state-of-the-art performance, remaining competitive with 4B-class models in coding, mathematics, long-context understanding, tool use and agentic tasks. The release includes a tech report, GitHub repository and online demo, and is currently trending on Hugging Face.

Hugging Face trending modelsSep 5, 01:44 UTC · 11d agoModel release1

OpenBMB Releases MiniCPM5-2B: A 2.52B Dense Model Averaging 53.9 Across 34 Benchmarks and Built to Run On Device

OpenBMB released MiniCPM5-2B, a 2.52B-parameter Apache 2.0 on-device model averaging 53.9 across 34 benchmarks, ahead of Qwen3.5-4B.

OpenBMB released MiniCPM5-2B, a 2,516,756,480-parameter dense LlamaForCausalLM model with grouped-query attention and a 131,072-token context, under Apache 2.0, runnable via vLLM, SGLang, llama.cpp, and Ollama. It averages 53.9 across 34 benchmarks versus 51.1 for Qwen3.5-4B, with strong tool-use (97.1 on tau2-Bench Telecom) and code results (69.1 LiveCodeBench v6, 46.4 SWE-bench Verified). Training combined 400B tokens of deep-thinking SFT, critic-based JustRL II RL teachers, and on-policy distillation merging 16 RL experts; datasets and intermediate checkpoints were published alongside the weights.

MarkTechPostSep 7, 19:18 UTC · 8d agoModel release

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AISep 8, 04:36 UTC · 8d agoAI tools & infra HN 58↑ · 19 comments1

m-a-p/YuE2-3B — new model trending #30 on Hugging Face

M-A-P released YuE2-3B, an open music generation model that outperforms Suno v5 on WildSongBench and runs locally on a 24GB GPU.

The M-A-P (multimodal-art-projection) team released YuE2-3B, an open-weights music generation model that turns lyrics and a style prompt into full songs with vocals and accompaniment. It uses an AR-NAR Mixture-of-Transformers backbone with symbolic planning and flow matching through a VAE, and supports editable scores (melody and chords, including ABC notation) plus agentic editing workflows. On 192 WildSongBench prompts it reports a SongBench average of 6.9632 (best-of-8) versus 6.8721 for Suno v5, claimed as state of the art among evaluated open and proprietary models. It runs 48 kHz stereo inference locally on a single 24GB NVIDIA GPU without quantization, with companion releases including YuE2-Vae, MERT-v2 encoders, the WildSongBench dataset, and SheetSage2.

Hugging Face trending modelsupdated Sep 12, 05:56 UTC · 4d agofirst Sep 9, 18:30 UTC · 6d agoModel release 7 sources1

E2A-Bench: Benchmarking Evidence-to-Action Reliability in Financial Chart Reasoning

E2A-Bench, a 969-query financial chart reasoning benchmark, finds VLMs fail evidence-to-action consistency, with fine-tuning amplifying BUY:SELL bias 4-6x.

E2A-Bench is a 969-query benchmark built from 323 HS300 constituents across three input modalities with deterministic OHLCV-derived evidence anchors, evaluating grounding, reasoning-action consistency, evidence-confidence calibration, and directional coverage via UCR, RCI, ECI, and NDR metrics. Testing 20 VLMs showed the lowest-hallucination model ranked near the bottom on coverage with only 6.4% directional coverage, and oracle-aided verification reduced unsupported claims but could collapse coverage. Financial fine-tuning amplified the BUY:SELL ratio by factors of 4.21 to 4.68 across base-fine-tuned pairs.

Hugging Face daily papersSep 12, 20:00 UTC · 3d agoAI research

Introducing the Agents API

OpenAI launched the Agents API in public beta, exposing the Codex agent harness, managed sandboxes, and multi-agent orchestration to developers.

OpenAI introduced the Agents API in public beta, giving developers the same agent harness and infrastructure that powers Codex through a single API call specifying task, model, tools, and environment. It supports OpenAI-managed sandboxes, customer infrastructure, or partner environments from providers including Cloudflare, Modal, E2B, Vercel, Oracle, DigitalOcean, Blaxel, Daytona and Runloop. Features include automatic context compaction for long sessions, tool search and programmatic tool calling to reduce token usage, and multi-agent support for parallel subagents. The harness is open-source Codex code; there are no extra API fees during beta, with developers paying only for tokens and tools used.

OpenAI Newsupdated Sep 11, 08:11 UTC · 5d agofirst Sep 10, 00:00 UTC · 6d agoAI tools & infra 4 sources

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-securitySep 4, 21:23 UTC · 11d agoVulnerability

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-securitySep 5, 12:16 UTC · 11d agoVulnerability CVE-2026-86137 CVE-2026-86138

The History Is the Detector: Executing CVE Patch History, End-to-End

BUGSTONE-E2E converts CVE patch history into executable LLM-guided detection rules, yielding 1,033 rules and 644 runtime-verified findings across 14 programs.

The BUGSTONE-E2E framework mines reusable detection rules from verified fixing commits, organized by CWE and language, and applies them through a funnel pipeline that escalates from Tree-sitter anchors and lightweight heuristics to LLM-based agent inspection, runtime verification, and scope-checked patch generation. Built from 19,325 high-severity CVEs published 2022-2026, it produced 1,033 detection rules spanning 56 CWE families, packaged into 172 skills. Applied across 14 programs, it generated runtime evidence for 644 findings, demonstrating that vulnerability history can drive reproducible detection and repair.

arXiv cs.CRSep 4, 16:40 UTC · 12d agoResearch

Ambient @ EgoLongQA 2026: Distilling Long-Video perception into a Sub-2B Model

Ambient team wins EgoLongQA 2026 sub-2B division by distilling an agentic long-video perception pipeline into a 2B vision-language model.

Ambient's entry to the EgoLongQA track of the Wearable-AI Challenge at ECCV 2026 placed first in the <=2B parameter division with 0.8279 on the held-out test set. The system distills the junior perception module of a tool-using agentic pipeline into a 2B student, reaching 89% of the pipeline's accuracy with 1.1% of its parameters and lifting a 27.1% base model to 81.4%. To meet the division limit, the multilingual embedding table is pruned from 248,320 to 143,469 rows, reaching 1.9985B parameters with provably identical logits on retained rows.

Hugging Face daily papersSep 9, 20:00 UTC · 6d agoAI research

From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions

Researchers specify EBL-Core, an execution-boundary conformance profile binding AI agent intents, policies, and evidence into verifiable execution grants, validated with bounded tests.

The paper defines EBL-Core, a conformance profile deciding whether one fully materialized AI-generated candidate action may receive action-scoped execution authority. It binds a structured intent object, Root and Operational Policies, typed evidence, and a verifiable Decision Derivation through an Execution Release Contract, with lifecycle rules for Redemption and Revocation. Evaluation included 34 static vectors, 15 lifecycle checks, and 100 trials of 32 concurrent Redemption attempts yielding exactly one winner per trial. The authors state these bounded results demonstrate executability of the specified subset, not production readiness or complete mediation.

arXiv cs.CRSep 10, 14:21 UTC · 6d agoAI safety & security1

BreezeBlue/Breeze-TTS-2 — new model trending #19 on Hugging Face

BreezeBlue open-weights Breeze TTS 2, a bilingual text-to-speech model it ranks #1 among open-weight models on the Artificial Analysis TTS leaderboard.

BreezeBlue released open weights and Apache 2.0-licensed PyTorch inference code for Breeze TTS 2 on 2026-08-25. The text-to-speech model supports English and Chinese, voice cloning, reference-free voice design, voice direction, and inline vocal events like (laugh) and (sigh). Reported performance includes #1 open-weight ranking on the Artificial Analysis Elo leaderboard, under 40 ms time-to-first-audio, a 0.32 real-time factor on an NVIDIA H100, and about 7.7 GiB GPU memory for eager inference.

Hugging Face trending modelsAug 25, 16:39 UTC · 22d agoModel release

ActReview: Rebuttal-Guided Training Data and Rubric Rewards for Actionable Peer Review Generation

ActReview post-trains Qwen3-8B-Base on OpenReview rebuttals to generate actionable peer-review feedback with grounded revision suggestions, benchmarked on 1,000 curated instances.

The paper defines Actionable Peer-review Generation as diagnostic claim generation plus revision suggestion generation and introduces ActReview, a rebuttal-guided post-training framework. From OpenReview review-rebuttal threads the authors build ActReview-40K, aligning reviewer weaknesses with author responses grounded in localized paper evidence, and post-train Qwen3-8B-Base with multi-task SFT followed by GRPO using weakness-specific rubric rewards. They also release ActReview-Bench, a human-curated 1,000-instance benchmark, on which ActReview outperforms prior specialized review-generation models on actionability and grounding while remaining competitive with strong prompt-based LLMs. Human evaluation confirms improved revision usefulness but identifies a remaining gap in technical accuracy.

Hugging Face daily papersSep 7, 20:00 UTC · 8d agoAI research

How the EITest Campaign's Path to Angler EK Evolved Over Time

Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.

Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.

Palo Alto Unit 42Aug 17, 09:51 UTC · Aug 17, 2026Threat actor in the wild

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.

CVE-2026-66066 (KindaRails2Shell), discovered by Ethiack researchers and independently by RyotaK of GMO Flatt Security, lets attackers upload crafted files that exploit libvips' handling of specialty formats to read arbitrary files, including process environment secrets, potentially escalating to RCE. Default Rails 7.0+ setups using Active Storage with the vips processor are affected before versions 7.2.3.2, 8.0.5.1, and 8.1.3.1; fixes shipped July 29, 2026, with VIPS_BLOCK_UNTRUSTED as a partial mitigation. Proof-of-concept exploits circulated after disclosure, and VulnCheck updated that it observed active exploitation originating from a single French IP establishing C2 to a host in Israel. Akamai deployed WAF rules, but experts stress patching and credential rotation over filtering alone.

Help Net SecurityAug 31, 12:00 UTC · 16d agoVulnerability in the wildCVE-2026-66066

Ebyte NA111-M

CISA reports 13 vulnerabilities, including CVSS 9.8 missing-authentication flaws, in Ebyte NA111-M firmware that allow full device compromise.

CISA published ICS advisory ICSA-26-239-05 for Ebyte NA111-M firmware 9013-2-17, listing 13 vulnerabilities tracked from CVE-2026-73125 through CVE-2026-77977. The issues include missing authentication for critical functions, GET requests with sensitive query strings, cross-site request forgery, improper restriction of excessive authentication attempts, and missing authorization. The vendor-assessed CVSS v3 score is 9.8, and successful exploitation could allow an attacker to fully compromise the device. No remediation details are included in the summary text.

CISA AdvisoriesAug 27, 12:00 UTC · 20d agoAdvisory CVE-2026-73125 CVE-2026-76179 CVE-2026-75814+10 CVEs

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.

Exploit-DB entry 52681 documents a remote code execution vulnerability in FreePBX 17.0.2, a widely used open-source PBX platform. The listing contains no CVE id, authentication requirement, or evidence of in-the-wild exploitation. FreePBX is commonly internet-facing, so unauthenticated RCE would be significant for exposed deployments.

Exploit-DBSep 3, 00:00 UTC · 13d agoExploit / PoC2

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-19773, an unauthenticated out-of-bounds write allowing remote code execution in libwebsockets HTTP/2 HPACK parsing, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-590 for an out-of-bounds write vulnerability in libwebsockets' HTTP/2 HPACK path header parsing. A remote attacker can execute arbitrary code on affected installations without authentication. The flaw is tracked as CVE-2026-19773 and carries a CVSS score of 9.8.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-19773

IFM Releases K2 Horizon: Six Apache 2.0 Models From 0.9B to 375B

MBZUAI's IFM released K2 Horizon, six Apache 2.0 models (0.9B-375B) with open training data, code, and checkpoints, claiming the largest fully open-source launch.

The Institute of Foundation Models (IFM), launched by MBZUAI, released K2 Horizon: six Apache 2.0 models (0.9B, 3.7B, 7B, 32B, 36B-A4B, 375B-A23B) shipping with the ~20-trillion-token pretraining corpus, intermediate checkpoints, training code, and logs, which IFM calls the largest fully open-source launch in AI history. The 375B-A23B scores 70.2 on Terminal-Bench 2.1 and 87.3 on GPQA Diamond; the 7B model posts 70.6 on SWE-bench Verified. New techniques include MoVA, which extends MoE routing into attention (36B total, ~4B active), and Uno, a LoRA adapter giving roughly 3x lossless decoding speedup. IFM's own reward-hacking audit re-scored 375B-A23B from 70.2% to 66.9% after flagging 24 of 712 Terminal-Bench trials.

MarkTechPostSep 7, 05:00 UTC · 9d agoModel release1

USN-8746-1: libEBML vulnerability

Ubuntu released USN-8746-1 fixing a libEBML buffer overflow that could let an attacker cause a denial of service.

Ubuntu issued security notice USN-8746-1 addressing incorrect handling of certain read and write operations in libEBML. The flaw could allow a buffer overflow resulting in denial of service. Users should apply the updated packages.

Ubuntu Security Noticesupdated 11:33 UTC · 6h agofirst Sep 10, 15:48 UTC · 6d agoAdvisory 12 sources

DianShi-RxnDB: A Large-Scale, Fine-Grained Organic Reaction Data Platform Built via a Fully Automated Pipeline for Researchers and AI Agents

Researchers release DianShi-RxnDB, a database of roughly 24 million organic reaction instances extracted automatically from USPTO and EPO patents since 1976.

DianShi-RxnDB is built by a fully automated pipeline integrating patent text, images, and reaction schemes, yielding about 24 million reaction instances, of which 14.8 million (61.7%) pass automated qualification checks. Manual evaluation of 1,300 sampled instances showed 92.95% field-level accuracy, and comparisons with Pistachio found advantages in deduplicated record counts and granularity. The platform offers a web research workbench and a Model Context Protocol (MCP) service enabling AI agents to perform composable structured retrieval.

Hugging Face daily papersSep 5, 20:00 UTC · 10d agoAI research

The Semantic Bottleneck: Leveraging Semantic Representations for Non-Invasive Speech Decoding

Researchers introduced Brain2Semantics2Text, decoding sentence meaning from non-invasive MEG brain recordings via a semantic bottleneck, improving on prior Brain2Text methods.

The paper proposes Brain2Semantics2Text, a non-invasive speech decoding method that maps sentence-level magnetoencephalography (MEG) responses into a semantic embedding space and inverts those embeddings into natural language. Motivated by evidence that high-level semantic representations are distributed across cortex and evolve on slower timescales, the approach targets meaning rather than phonemes or words, avoiding the need for word-level alignment. The authors report improved sentence-level results compared to prior non-invasive Brain2Text methods despite the low signal-to-noise ratio of neural recordings.

Hugging Face daily papersSep 8, 20:00 UTC · 7d agoAI research2

USN-8768-1: Shibboleth vulnerability

Ubuntu patches Shibboleth SQL injection in the ODBC storage plugin allowing remote attackers to extract sensitive information.

Ubuntu security notice USN-8768-1 fixes a Shibboleth vulnerability discovered by Florian Stuhlmann. The software incorrectly escaped input when using the ODBC storage plugin, allowing a remote attacker to perform SQL injection attacks and obtain sensitive information. Users are advised to update the Shibboleth package.

Ubuntu Security NoticesSep 15, 15:43 UTC · 1d agoAdvisory

IFM/K2-Horizon-MoVA-36B-A4B — new model trending #15 on Hugging Face

IFM released K2-Horizon-MoVA-36B-A4B, an open-weights 36B-parameter MoE model with 4B active parameters and native 512K context.

IFM released the final checkpoint of K2-Horizon-MoVA-36B-A4B, a sparse Mixture-of-Experts model using Mixture-of-Values (MoVA) attention with 36B total and 4B active parameters. The model supports native 524,288-token context and reportedly outscores open-weight dense and MoE models up to 15x its size on agentic and reasoning benchmarks, while competing against closed frontier models. Intermediate checkpoints, training data, the training recipe, and training code are slated for public release.

Hugging Face trending modelsSep 1, 23:01 UTC · 14d agoModel release

EITest Campaign Evolution: From Angler EK to Neutrino and Rig

Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.

Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.

Palo Alto Unit 42Aug 17, 09:52 UTC · Aug 17, 2026Threat actor in the wild

GE-Act 2.0: Pretraining and Scaling a World-Action Model for Robotic Manipulation

GE-Act 2.0 is a from-scratch pretrained world-action model for robotic manipulation, with success rising from 17.1% to 44.1% as co-training data scales to 30,000 hours.

Genie Envisioner Act 2.0 (GE-Act 2.0) is a world-action model whose generative and action components are all initialized from scratch on manipulation data, combining a control-oriented autoencoder (CoAE), single-step visual planner (SVP), and inverse dynamics model (IDM) trained jointly via knowledge-aligned selective optimization (KASO). Scaling co-training data from 300 to 30,000 hours raises zero-shot success from 17.1% to 44.1% on G1-OP and 13.4% to 31.1% on G2-90D, despite the latter comprising under 2% of data, suggesting cross-embodiment transfer. Gains span 19/20 and 18/20 skill groups, and skill-specific coverage correlates with zero-shot OOD success (Pearson r=0.80).

Hugging Face daily papersSep 3, 20:00 UTC · 12d agoAI research

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commitsSep 8, 19:22 UTC · 7d agoTools

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42Aug 19, 12:03 UTC · 28d agoExploit / PoC in the wildCVE-2023-335381

USN-8772-1: AOM vulnerabilities

Ubuntu USN-8772-1 patches four libaom flaws (CVE-2026-56208 to CVE-2026-56211) that could cause heap overflow, arbitrary memory writes, or code execution.

Ubuntu Security Notice USN-8772-1 fixes a heap buffer overflow in libaom's first-pass statistics buffer handling in Look-Ahead Processing mode (CVE-2026-56208), potentially causing denial of service or arbitrary code execution. Three additional flaws in spatial and temporal layer ID validation in the SVC encoder controls (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) allow arbitrary memory writes, out-of-bounds heap reads, or code execution. Users should apply the updated packages.

Ubuntu Security Notices09:29 UTC · 8h agoAdvisory CVE-2026-56208 CVE-2026-56209 CVE-2026-56210+1 CVEs