ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “heap overflow”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 416Exploit / PoC 160Ransomware 31Advisory 15Malware 13Industry 6Data breach 5Threat actor 3AI industry 1Phishing & fraud 1Research 1Tools 1
SeverityAllcritical 383high 178medium 82low 9info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle Outside In Technology's PostScript parsing (CVE-2026-60412) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-636, a CVSS 7.8 heap-based buffer overflow in PostScript file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code when the target opens a malicious file or visits a malicious page, making user interaction a requirement. The vulnerability is tracked as CVE-2026-60412. The advisory reports no exploitation.

ZDI Published Advisories · 7d agoVulnerability 4 sourcesCVE-2026-604121

Heap overflow in kernel driver due to missing size validation

Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.

Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.

Fortinet PSIRT · Aug 12, 2026Advisory

ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.

Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.

ZDI Published Advisories · 7d agoVulnerability 6 sourcesCVE-2026-71116

ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.

ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-721961

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow RCE (CVE-2026-24272, CVSS 7.8) in NVIDIA TensorRT ONNX parsing, requiring user interaction to exploit.

The Zero Day Initiative published advisory ZDI-26-591 covering a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. Successful exploitation allows remote code execution when a user opens a malicious ONNX file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24272.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-24272

ZDI-26-656: PAPPL Job Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-656: Unauthenticated heap-based buffer overflow in PAPPL job processing allows remote code execution, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-656 for PAPPL, the open-source printer application framework. A heap-based buffer overflow in job processing allows remote attackers to execute arbitrary code with no authentication required. ZDI assigned a CVSS 9.8 rating. No CVE identifier was listed in the advisory text.

ZDI Published Advisories · 6d agoAdvisory 2 sources

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-security · 11d agoVulnerabilityCVE-2026-86137CVE-2026-86138

USN-8772-1: AOM vulnerabilities

Ubuntu USN-8772-1 patches four libaom flaws (CVE-2026-56208 to CVE-2026-56211) that could cause heap overflow, arbitrary memory writes, or code execution.

Ubuntu Security Notice USN-8772-1 fixes a heap buffer overflow in libaom's first-pass statistics buffer handling in Look-Ahead Processing mode (CVE-2026-56208), potentially causing denial of service or arbitrary code execution. Three additional flaws in spatial and temporal layer ID validation in the SVC encoder controls (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) allow arbitrary memory writes, out-of-bounds heap reads, or code execution. Users should apply the updated packages.

Ubuntu Security Notices · 17h agoAdvisoryCVE-2026-56208CVE-2026-56209CVE-2026-56210+1 CVEs

ZDI-26-529: Samsung Galaxy S25 TIFF File Processing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI discloses CVE-2026-21045, a heap buffer overflow in Samsung Galaxy S25 TIFF processing enabling RCE via malicious files or pages.

ZDI-26-529 describes a heap-based buffer overflow in Samsung Galaxy S25 TIFF file processing that allows remote attackers to execute arbitrary code. User interaction is required, as the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 8.8, tracked as CVE-2026-21045.

ZDI Published Advisories · Aug 11, 2026VulnerabilityCVE-2026-21045

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-19781

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.

The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-24268

Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.

Microsoft disclosed CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker rated Important, which could allow an authorized attacker to execute arbitrary code locally, with possible in-network exploitation via arbitrary endpoint calls. Microsoft rates exploitation as Less Likely and there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core. Fixes shipped in the September 2026 Patch Tuesday cumulative updates via platform-specific KBs such as KB5124012 and KB5122871.

Cyber Security News · 7d agoVulnerabilityCVE-2026-694491

Windows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker allowing privileged local attackers to execute code; no exploitation reported.

Microsoft disclosed CVE-2026-69449 on September 8, 2026, an Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker with a CVSS 3.1 base score of 6.7. The attack vector is local (AV:L) with high privileges required, so exploitation needs privileged local access rather than remote access over the internet. Microsoft, as assigned CNA, has not reported public exploitation, and administrators are urged to inventory BitLocker-enabled systems and apply updates. Interim mitigations include least-privilege access, limiting administrative rights, and monitoring for unexpected elevated process activity.

GBHackers · 7d agoVulnerabilityCVE-2026-694491

The GNU C Library security advisories update for 2026-09-14

glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.

The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.

oss-security · 2d agoVulnerability 2 sources1

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including 113 critical, with two Windows privilege-escalation bugs (CVE-2026-81963, CVE-2026-85880) exploited in the wild.

Microsoft's September 2026 security update addresses 973 vulnerabilities across its product lineup, 113 rated critical, of which 82 are remote code execution flaws. Two vulnerabilities are confirmed exploited in the wild: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack (CVSS 7.8), and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (CVSS 7.8). Microsoft flags several bugs as more likely to be exploited, including a 9.8 RCE in Windows DNS Server (CVE-2026-69730), an 8.8 RCE in Windows Kerberos (CVE-2026-69676), and a 9.0 EoP in Spring Cloud Azure (CVE-2026-69854). Cisco Talos published accompanying Snort rules to detect exploitation attempts against the prominent flaws.

Cisco Talos · 8d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69676+27 CVEs

VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow

CERT/CC details CVE-2026-19874, a heap overflow in Metal Gear Online 3 letting match hosts execute code on lobby members' machines.

VU#728712 describes a heap-based buffer overflow in Konami's Metal Gear Online 3, tracked as CVE-2026-19874, affecting version 1.1.2.8 (Steam AppID 287700). The input-validation flaw lies in processing Steam lobby metadata tied to the player-removal feature, letting a match host trigger remote code execution on lobby members' machines via specially crafted data. The game is an 8v8 competitive shooter using Steam Matchmaking for lobbies.

CERT/CC Vulnerability Notes · 23d agoVulnerabilityCVE-2026-19874

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).

Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.

The Hacker News · 20d agoVulnerabilityCVE-2026-75604

ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-92208, an unauthenticated heap-based buffer overflow in NoMachine's mDNS service enabling network-adjacent remote code execution (CVSS 8.8).

ZDI published advisory ZDI-26-710 describing a heap-based buffer overflow vulnerability in NoMachine's mDNS service, tracked as CVE-2026-92208 with CVSS 8.8. Network-adjacent attackers can execute arbitrary code on affected installations without authentication. The advisory does not mention observed exploitation or patch availability.

ZDI Published Advisories · 22h agoVulnerabilityCVE-2026-92208

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.

A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.

Full Disclosure · 13d agoVulnerability

CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks

CISA added actively exploited Fortinet CVE-2025-25249, a critical heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE, to its KEV catalog.

CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) allowing unauthorized code execution by sending specially crafted packets. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2026, with a September 12 remediation deadline for federal agencies under BOD 26-04 and mandatory forensic triage of affected environments. Internet-facing Fortinet firewalls and SASE platforms are a likely foothold for credential theft, persistence, and lateral movement; ransomware use is currently listed as unknown.

Cyber Security Newsupdated · 6d agofirst · 6d agoExploit / PoC in the wild 6 sourcesCVE-2025-252492

Six new dnsmasq vulnerabilities open the door to DNS cache poisoning, local root

Six dnsmasq flaws enable DNS cache poisoning, DoS, memory leaks, and local root code execution; fixes ship in version 2.92rel2.

Researchers disclosed six dnsmasq vulnerabilities spanning memory safety and input validation, including heap buffer overflows in extract_name() and extract_addresses(), DNSSEC infinite-loop and out-of-bounds read flaws, and a DHCPv6 out-of-bounds write allowing local root code execution. Exploitation paths include DNS cache poisoning, bypassing security controls, remote denial of service, and local privilege escalation. Maintainers released version 2.92rel2 with fixes, and a stable 2.93 release is expected within weeks.

Help Net Security · 23d agoVulnerabilityCVE-2026-2291CVE-2026-4890CVE-2026-4891+3 CVEs

[remote] PCMan 2.0.7 - Buffer Overflow

A remote buffer overflow in PCMan 2.0.7 has a public proof-of-concept exploit published on Exploit-DB.

Exploit-DB listing 52657 discloses a remote buffer overflow vulnerability in PCMan version 2.0.7. A proof-of-concept exploit is publicly available, allowing attackers to potentially crash or compromise affected instances. The listing includes no CVE identifier and reports no observed exploitation in the wild.

Exploit-DB · Aug 18, 2026Exploit / PoC1

Apple Xcode Integer Underflow Flaw Lets Crafted Archives Leak Memory and Crash Builds

Researchers disclosed an integer underflow in Apple's Mach-O archive parser that lets crafted static libraries crash Xcode builds or leak process memory.

SecureLayer7 disclosed an integer underflow in the mach_o::Archive::Entry::name() function in Apple's open-source dyld project, reported to Apple Product Security on May 23, 2026, with no public patch after more than 90 days. Crafted static archives (.a files) cause the parser's unsigned index to wrap to SIZE_MAX, producing SIGSEGV crashes in the ld-prime linker, out-of-bounds reads that may print adjacent memory to stderr, or SIGABRT in libtool and ranlib. The modern parser is used by ld-prime, the default linker for arm64, arm64e, and x86_64 since Xcode 15, while legacy ld-classic is unaffected. Crafted archives need only be processed, creating supply-chain risk via vendored SDKs, binary dependencies, and CI pipelines.

GBHackers · 6d agoVulnerability1

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News · 3d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs3

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputer · 8d agoAdvisory in the wildCVE-2026-69805CVE-2026-58649CVE-2026-69806+27 CVEs1

Check Point security advisory (AV26-902)

Canada's Cyber Centre issued advisory AV26-902 warning of two Check Point RCE flaws, including VPN authentication bypass CVE-2026-85102.

The Canadian Centre for Cyber Security released advisory AV26-902 on September 9, 2026, covering vulnerabilities in Check Point Security Gateway, Spark Firewall with Site-to-Site or Remote Access VPN, and Security Management Server across multiple versions. CVE-2026-85102 is an authentication bypass and remote code execution flaw in Remote Access and Site-to-Site VPN, while CVE-2026-85103 is an ASN.1 decoding heap overflow enabling remote code execution. Administrators are urged to review the linked advisories and apply updates as they become available.

Canadian Centre for Cyber Security · 7d agoAdvisoryCVE-2026-85102CVE-2026-85103

Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.

Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.

Infosecurity Magazine · 7d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-62878+4 CVEs1

CHERI-D Reincarnate: efficient multicore CHERI temporal memory safety through allocation reincarnation (draft version)

CHERI-D Reincarnate adds allocation reincarnation to CHERI, quarantining generation IDs instead of memory to cut temporal memory-safety overheads on multicore systems.

The proposal extends CHERI-D temporal memory safety by quarantining exhausted generation IDs rather than memory slots, allowing freed memory immediate reuse through allocation reincarnation. It adds coherent ID caching and multicore support connecting physical coherence events to the virtually addressed ObjID buffer. The design was implemented as a hardware-software co-design across CHERI-Toooba FPGA softcore, QEMU, LLVM/Clang, and CheriBSD. Across evaluated workloads it substantially reduces memory-sweep frequency and quarantine overhead with low performance and hardware cost.

arXiv cs.CR · 6d agoResearch

U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.

CISA added CVE-2026-75650 (Adobe Commerce/Magento, CVSS 10.0), CVE-2026-81963 and CVE-2026-85880 (Microsoft Windows local privilege escalation, CVSS 7.8 each), and CVE-2026-86218 (N-able N-central pre-auth RCE, CVSS 10.0) to its Known Exploited Vulnerabilities catalog. Sansec researchers report the StyleSmuggler Magento flaw, actively exploited since September 4, lets unauthenticated attackers run code on vulnerable online stores and deploy web shells and backdoors; Microsoft confirmed active exploitation of both Windows flaws, and N-able shipped an emergency hotfix. Federal civilian agencies must patch the Windows flaws by September 22, 2026, and the remaining entries by September 11, 2026 under BOD 22-01.

Security Affairsupdated · 11h agofirst · 6d agoExploit / PoC in the wild 14 sourcesCVE-2026-75650CVE-2026-81963CVE-2026-85880+1 CVEs1

graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule

Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.

Evgenios Gkritsis publicly disclosed an algorithmic-complexity denial-of-service flaw in github.com/graphql-go/graphql affecting all released versions up to and including v0.8.1. The defect is triggered via the OverlappingFieldsCanBeMergedRule validation, is unauthenticated and network-reachable, and causes quadratic CPU exhaustion. No fixed version exists; the disclosure was public because the project has no private security-reporting channel or SECURITY.md.

oss-security · 2d agoVulnerability

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.

The Hacker News · 7d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+9 CVEs

thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program

The redirect CGI program shipped with thttpd v2.26 has a stack buffer overflow that unauthenticated attackers can trigger for crashes or possible code execution.

A stack-based buffer overflow exists in the redirect CGI program distributed with thttpd v2.26. Unsafe string concatenation when constructing redirect URLs from attacker-controlled CGI environment variables causes the overflow. A remote, unauthenticated attacker can trigger it via a crafted HTTP request, crashing the CGI process and causing denial of service. In environments lacking modern exploit mitigations, code execution may also be possible.

Full Disclosure · 13d agoVulnerability

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited zero-days: CVE-2026-85880, an ALPC heap buffer overflow, and CVE-2026-81963 in the Windows Update Stack, both CVSS 7.8 local privilege escalations. It also addresses an unauthenticated Exchange RCE (CVE-2026-55007) triggered by Visio attachment content indexing under memory pressure, an RDP use-after-free (CVE-2026-69525, CVSS 9.8), and 20 wormable flaws in DNS, DHCP, SMB, Active Directory, and other components. ZDI attributed the rising volume partly to AI-assisted vulnerability discovery, noting no corresponding spike in active exploits yet.

Security Affairs · 7d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+3 CVEs2

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.

The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-202151

Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.

Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).

SecurityWeek · 8d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+5 CVEs1

Stack buffer overflow in WAD

FortiOS explicit proxy WAD daemon stack buffer overflow (CVSS 5.1) allows code execution only with Kerberos and SOCKS configured.

Fortinet advisory FG-IR-26-161 describes a stack-based buffer overflow (CWE-121) in the WAD daemon of FortiOS explicit proxy, scored CVSSv3 5.1. Exploitation requires an attacker able to bypass stack protection and ASLR, and the explicit proxy must be configured with Kerberos authentication and SOCKS enabled. If successful, it yields arbitrary code or command execution in the WAD daemon context via crafted sockets. No exploitation is reported in the advisory.

Fortinet PSIRT · Aug 12, 2026Advisory

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA Advisories · 6d agoAdvisoryCVE-2026-87020

[dos] Nmap 7.99 - Extension Header Integer Underflow

A proof-of-concept denial-of-service exploit for Nmap 7.99 leverages an integer underflow in extension header parsing to crash the scanner.

Exploit-DB lists a denial-of-service proof of concept targeting Nmap version 7.99. The flaw is an integer underflow when handling extension headers, which can crash the scanner. No exploitation in the wild or patch details are mentioned in the listing.

Exploit-DB · Aug 17, 2026Exploit / PoC1

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.

CISA added CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these high-risk vulnerabilities on exposed assets and verify whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.

CISA Advisories · 7d agoExploit / PoC in the wildCVE-2025-25249CVE-2026-19490CVE-2026-87491+1 CVEs

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-security · 12d agoVulnerability