A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.

CVE Database V5

CVE-2026-107125: Heap-based Buffer Overflow in XnView Classic

ntfs-3g

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

CVE-2026-46571 is an out-of-bounds read vulnerability in the ntfs_fix_file_name() function located in libntfs-3g/reparse.c of NTFS-3G before version 2026.7.7. The vulnerability is triggered when a readlink system call is performed on a corrupted NTFS file crafted by an attacker. This can lead to unauthorized disclosure of potentially confidential information residing in the memory space of the ntfs-3g process.

An out-of-bounds read vulnerability exists in NTFS-3G versions prior to 2026.7.7 in the ntfs_fix_file_name() function. This flaw can be triggered by performing a readlink operation on a specially crafted corrupted NTFS file, potentially allowing an attacker to read sensitive information from the pro

CVE-2026-46571: n/a

A heap buffer overflow vulnerability exists in NTFS-3G versions prior to 2026.7.7 in the ntfs_ib_copy_tail() function within libntfs-3g/index.c. This flaw can be triggered by extending a directory, such as creating a file, using a crafted malicious NTFS image. The vulnerability affects the SUID-root ntfs-3g binary and allows heap memory corruption.

CVE-2026-46569 describes a heap buffer overflow in the ntfs_ib_copy_tail() function of NTFS-3G before version 2026.7.7. The vulnerability occurs when a malicious NTFS image is used to extend a directory, which corrupts heap memory in the SUID-root ntfs-3g binary. This could potentially lead to privilege escalation or other memory corruption consequences. The issue is located in libntfs-3g/index.c.

A heap buffer overflow vulnerability exists in NTFS-3G versions prior to 2026.7.7 in the ntfs_ib_copy_tail() function within libntfs-3g/index.c. This flaw can be triggered by extending a directory, such as creating a file, using a crafted malicious NTFS image. The vulnerability affects the SUID-root

CVE-2026-46569: n/a

wger

wger versions prior to 2.6 contain an authorization bypass vulnerability allowing authenticated attackers to inject arbitrary workout log entries into other users' SlotEntry records. This occurs because the slot_entry foreign key is not verified for ownership, enabling cross-user data injection that corrupts victims' workout progression calculations. The issue is fixed in version 2.6.

In wger versions before 2.6, an authenticated attacker can supply another user's slot_entry ID in a POST request to /api/v2/workoutlog/, bypassing ownership checks due to missing verification of the slot_entry foreign key in WorkoutLogViewSet.get_owner_objects(). This allows injection of arbitrary workout log entries into the victim's SlotEntry. Because SlotEntry.get_config_data() retrieves logs without filtering by user, the injected data affects the victim's auto-generated workout targets. The vulnerability is addressed in version 2.6.

wger versions prior to 2.6 contain an authorization bypass vulnerability allowing authenticated attackers to inject arbitrary workout log entries into other users' SlotEntry records. This occurs because the slot_entry foreign key is not verified for ownership, enabling cross-user data injection that

CVE-2026-46438: CWE-639: Authorization Bypass Through User-Controlled Key in wger-project wger

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.

CVE-2026-46570: n/a

Description

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional