Apache mod_vhost_alias one-byte stack overflow (CVE-2026-109163)
Apache rates the overflow low; the body names 2.4.69 while the title also lists 2.4.70.
Stories per day · 30 days
11 RSS
Relatedrce11alpine6brotli6ilx-f5116originlab6origin-viewer6pwn2own6zero-day6dotnet5zdi5microsoft4bluetooth3nodejs3oop3privilege-escalation3remote-code-execution3ubuntu3android-auto2
108 stories, newest first · one card per story
Stories tagged #buffer-overflow
glibc 2.2–2.44 wide scanf writes one byte past buffer
GLIBC-SA-2026-0027 says %s and %[ without the l modifier add an extra null in wide scanf conversions.
Microsoft patches Active Directory network RCE rated Important
CVE-2026-119948 is a CVSS 7.5 stack overflow needing low privileges; Microsoft reports no known exploitation.
Ubuntu warns of HPLIP memory flaws that may allow code execution
Two named CVEs cover memory corruption; a third issue is insecure file permissions, with no exploitation stated.
FortiManager and FortiAnalyzer GUI flaws allow authenticated code execution
FG-IR-26-227 combines CWE-94 code injection and a CWE-120 buffer overflow, scored CVSS 7.2.
Origin Viewer OPJ parsing heap-based buffer overflow enables remote code execution (CVE-2026-114568)
Origin Viewer OPJ file parsing allows remote code execution with user interaction required (CVE-2026-114568).
Patched Zyxel GS1900 switches remain open to CVE-2026-107441 exploit
Binarly discovered the CVE-2026-107441 exploit still works on firmware fixed for a different CVE.
unixODBC <=2.3.14 Multiple Heap Buffer Overflows
Heap buffer overflows, underflows, and over-reads in unixODBC can corrupt shared heap state across connections and cause denial of service.
ZDI-26-870: Ashlar-Vellum Cobalt XE stack buffer overflow RCE
Ashlar-Vellum Cobalt XE file parsing vulnerability allows remote code execution with user interaction; ZDI assigned CVSS 7.8.
Apache OpenOffice vulnerable to heap-based buffer overflow in PDF parsing (CVE-2026-90624)
Heap-based buffer overflow in PDF import code of Apache OpenOffice through 4.1.16 can lead to remote code execution.
psqlODBC before 18.00.0006 hit by stack buffer overflow
Canadian Centre for Cyber Security advisory AV26-1115 warns psqlODBC users must upgrade to 18.00.0006 to fix large-object read buffer overflow in ODBC escape parser.
Zyxel GS1900 switches and APs hit by out-of-bounds write and buffer overflow
Zyxel security advisory AV26-1114 reports out-of-bounds write in GS1900 series switches and buffer overflow in APs FWA7 Security Routers; users should apply updates.
WatchGuard discloses seven critical Fireware OS flaws enabling remote code execution
Supplied data names Fireware OS 2026.4 and 12.12.4 as fixes; this report does not establish exploitation.
2
Qpid Proton C through 0.40.0 can overflow on bad TLS wildcards
Apache rates the stack read overflow low and says only non-RFC9525 wildcard certificates trigger it; 0.41.1 fixes it.
TeamViewer flaws before 15.83 allow code execution in sessions
Three high-severity bugs score up to 8.8, and TeamViewer reported no known active exploitation.
1
16-year-old EDK II PXE buffer overflow runs code before Secure Boot
CVE-2026-97631 lets an adjacent-network attacker hang or hijack network boots on servers, and no stable EDK II release ships the fix yet.
CVE-2026-97631 lets attackers run code before the OS on EDK II PXE boots
An unauthenticated ICMP sender can overflow a 504-byte field during PXE boot; AMI’s fix surfaced early and affected devices remain unclear.
Alpine iLX-F511 Android Auto overflow allows adjacent code execution
ZDI scores the unauthenticated Pwn2Own zero-day at CVSS 8.8 for network-adjacent attackers.
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
Microsoft issues emergency .NET fixes for four vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.