FortiManager and FortiAnalyzer heap overflow lets admins run code
The CVSS 7.2 flaw is triggered by crafted JSON-RPC requests and can also cause a denial of service.
Stories per day · 30 days
6 RSS
Relatedxorg9rce8zdi8privilege-escalation7denial-of-service5godot5local5x-org-server5f54memory-corruption4nginx4remote-code-execution3buffer-overflow2disputed-cve2fortianalyzer2fortimanager2fortinet2game-engine2
67 stories, newest first · one card per story
Stories tagged #heap-overflow
X.Org libXrender reply overflow allows remote code execution
Exploitation needs a connection to a malicious X11 server; ZDI rates CVE-2026-88807 at CVSS 8.8.
Vim < 9.2.1309 Heap Buffer Overflow with Crafted Spell File
Crafted spell file causes Vim to treat SN_SOFO sections as SN_SAL items leading to out-of-bounds read.
Practical Guide to Out-of-Tree Mitigations on Linux
Step-by-step instructions for deploying hardened allocators such as hardened_malloc, mimalloc secure mode, and scudo to defend against heap overflows and use-after-free bugs on Linux.
1
LibreOffice dBase parser heap overflow allows code execution
ZDI rates CVE-2026-76181 at CVSS 7.8 and says the target must open a malicious file or page.
OriginLab Origin Viewer OGWU Parsing RCE (CVE-2026-114569)
ZDI assigns CVSS 7.8 to heap-based buffer overflow in OGWU parser; remote code execution requires opening malicious file.
unixODBC <=2.3.14 Multiple Heap Buffer Overflows
Heap buffer overflows, underflows, and over-reads in unixODBC can corrupt shared heap state across connections and cause denial of service.
Apache OpenOffice through 4.1.16 heap out-of-bounds write in WW8 PLCF reader
Heap out-of-bounds write in Apache OpenOffice versions through 4.1.16 allows crafted Microsoft Word documents to crash the program or corrupt memory; upgrade to 4.1.17 recommended.
Apache Traffic Server heap-buffer-overflow via HTTP Host header
90-day disclosure of heap-buffer-overflow in Apache Traffic Server master branch due to unbounded alloca in HttpTransact.cc.
TeamViewer before 15.83 can be crashed via crafted screen data (CVE-2026-111585)
A malicious host in an established support session can overflow the viewer heap; TeamViewer reports no known exploitation.
1
Godot 3.2.2–4.7.2 remote crash via DTLS heap overflow
DTLS is opt-in; the flaw was runtime-confirmed on the official 4.7-stable Windows release template, with no fix named.
OpenJPEG 2.4.0 through 2.5.4 assigned CVE-2026-107080 for heap overflow
MITRE describes an out-of-bounds read and write that can cause denial of service; the proposed fix is still unmerged.
jxrlib memory bugs on damaged JPEG XR fixed in fork 1.4.4
A few-hundred-byte damaged file can trigger a heap overflow write, and most distributions still ship unfixed code.
Ubuntu warns of zlib heap overflow in non-blocking writes
Ali Firas found mishandled writes that can crash zlib or allow arbitrary code execution.
RUGGEDCOM CROSSBOW SAC before 6.0 includes vulnerable SQLite code
Five SQLite flaws can yield code execution, denial of service, or information disclosure; the product fix is V6.0 or later.
NoMachine nxwebrunner heap overflow allows unauthenticated RCE
ZDI rates CVE-2026-114549 at CVSS 9.8; the snippet names no versions and no confirmed attacks.
GPAC MP4Box heap overflow via crafted AC-4 file (CVE-2025-60480)
The medium-severity out-of-bounds heap read is fixed in commit e02d1fd and rated CVSS 6.5.
F5 ships emergency patches for three critical NGINX flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
F5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
CVE-2025-55640 is a heap overflow in GPAC MP4Box triggered by crafted MP4 sample metadata.
F5 addressed critical RCE flaws in NGINX
F5 patched three critical NGINX flaws that can allow unauthenticated remote code execution.
ZDI-26-782: LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a LibreOffice PDF parsing overflow that can enable remote code execution.
Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
Godot 4.x Radiance HDR loader flaw CVE-2026-110734 is disputed and scored CVSS 2.5.
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 fix five flaws, including possible worker RCE and a TLS client-cert bypass.