35
35
30
thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program
The redirect CGI program shipped with thttpd v2.26 has a stack buffer overflow that unauthenticated attackers can trigger for crashes or possible code execution.
A stack-based buffer overflow exists in the redirect CGI program distributed with thttpd v2.26. Unsafe string concatenation when constructing redirect URLs from attacker-controlled CGI environment variables causes the overflow. A remote, unauthenticated attacker can trigger it via a crafted HTTP request, crashing the CGI process and causing denial of service. In environments lacking modern exploit mitigations, code execution may also be possible.
25
35
35
35
45
ZDI-26-655: PAPPL Printer IPP Processing Stack-based Buffer Overflow Local Privilege Escalation Vulnerability
ZDI-26-655: Stack-based buffer overflow in PAPPL printer IPP processing enables local privilege escalation, rated CVSS 7.8.
The Zero Day Initiative published advisory ZDI-26-655 for PAPPL. A stack-based buffer overflow in printer IPP processing allows local attackers to escalate privileges after obtaining low-privileged code execution. ZDI assigned a CVSS 7.8 rating. No CVE identifier was listed in the advisory text.
25
ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.
Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.
27
ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a heap-based buffer overflow in Oracle Outside In Technology's PostScript parsing (CVE-2026-60412) enabling user-triggered remote code execution.
Zero Day Initiative published ZDI-26-636, a CVSS 7.8 heap-based buffer overflow in PostScript file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code when the target opens a malicious file or visits a malicious page, making user interaction a requirement. The vulnerability is tracked as CVE-2026-60412. The advisory reports no exploitation.
22
ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a heap-based buffer overflow RCE (CVE-2026-24272, CVSS 7.8) in NVIDIA TensorRT ONNX parsing, requiring user interaction to exploit.
The Zero Day Initiative published advisory ZDI-26-591 covering a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. Successful exploitation allows remote code execution when a user opens a malicious ONNX file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24272.
25
ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.
The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.
25
ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.
The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.
25
ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.
The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.
12
35
VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow
CERT/CC details CVE-2026-19874, a heap overflow in Metal Gear Online 3 letting match hosts execute code on lobby members' machines.
VU#728712 describes a heap-based buffer overflow in Konami's Metal Gear Online 3, tracked as CVE-2026-19874, affecting version 1.1.2.8 (Steam AppID 287700). The input-validation flaw lies in processing Steam lobby metadata tied to the player-removal feature, letting a match host trigger remote code execution on lobby members' machines via specially crafted data. The game is an 8v8 competitive shooter using Steam Matchmaking for lobbies.
40
35
35
30
35
35
35
35
35
Windows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker allowing privileged local attackers to execute code; no exploitation reported.
Microsoft disclosed CVE-2026-69449 on September 8, 2026, an Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker with a CVSS 3.1 base score of 6.7. The attack vector is local (AV:L) with high privileges required, so exploitation needs privileged local access rather than remote access over the internet. Microsoft, as assigned CNA, has not reported public exploitation, and administrators are urged to inventory BitLocker-enabled systems and apply updates. Interim mitigations include least-privilege access, limiting administrative rights, and monitoring for unexpected elevated process activity.
40
Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.
Microsoft disclosed CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker rated Important, which could allow an authorized attacker to execute arbitrary code locally, with possible in-network exploitation via arbitrary endpoint calls. Microsoft rates exploitation as Less Likely and there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core. Fixes shipped in the September 2026 Patch Tuesday cumulative updates via platform-specific KBs such as KB5124012 and KB5122871.
50
35
30
30
35
45
30
35
Re: Vulnerabilities fixed in libxml2-2.15.4
libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.
libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.
45
30
30
35
The GNU C Library security advisories update for 2026-09-14
glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.
The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.
38
35