VVdeC before 3.2.1 has out-of-bounds read (CVE-2026-124310)
A crafted VVC bitstream reaches Slice::getRefPic; the issue is CWE-129, scored CVSS 6.1, with a published fix commit.
Stories per day · 30 days
3 RSS
Relatedbrotli3game-engine3godot3cisco2nodejs2snort2ap1buffer-overflow1code-execution1cwe-1291cwe-7871denial-of-service1emudhra1gs19001hardening1hdr1image-loader1io-compress-brotli1
15 stories, newest first · one card per story
Stories tagged #out-of-bounds
libnfs ZDR decoding flaw can crash the library or run code
Ubuntu says missing maximum-size enforcement during ZDR decoding causes an out-of-bounds write in libnfs.
Zyxel GS1900 switches and APs hit by out-of-bounds write and buffer overflow
Zyxel security advisory AV26-1114 reports out-of-bounds write in GS1900 series switches and buffer overflow in APs FWA7 Security Routers; users should apply updates.
Cisco Snort header unfolding flaw enables remote code execution
Unauthenticated remote code execution vulnerability in Cisco Snort with CVSS 9.8.
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
IO::Compress::Brotli before 0.023 has decoder out-of-bounds write
Perl module versions from 0.004001 before 0.023 ship a brotli library whose decoder can write out of bounds (CVE-2026-115936).
Godot 4.x Radiance HDR loader heap write fix merged
Pull request 124697 rejects bad image sizes and bounds RLE runs; its body cites CVE-2026-110734.
Node.js patches Brotli decoder bug that may allow code execution
Fixed builds are 22.23.4, 24.22.1, and 26.12.1; a public proof of concept did not achieve code execution on a standard build.
Cisco ships Snort 3 hardening for CVE-2026-20043 out-of-bounds writes
An internal Snort 3 review grouped multiple out-of-bounds write issues, CWE-787, under CVE-2026-20043.
CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
Apache DataSketches C++ 4.1.0–5.2.0 has an out-of-bounds read and write in Count-Min sketch deserialization.
MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
CVE-2026-86950: The Great Glyph Grift - An in-the-wild iOS bug with a possible WhatsApp zero-click path
Apple fixed in-the-wild CoreGraphics CVE-2026-86950 in iOS 26.7.1; crafted PDF fonts can trigger an out-of-bounds write.
11
VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.
USN-8737-2: GNU C Library vulnerabilities
Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.
Xen Security Advisory 513 v3 (CVE-2026-79605,CVE-2026-79606) - Out-of-bounds accesses in Tapdisk
Xen published XSA-513 (CVE-2026-79605 and CVE-2026-79606): incorrect bounds checks in Tapdisk, the XAPI toolstack userspace xen-blkback, allow out-of-bounds accesses.