Threat database

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.

CVE-2026-111140 is a heap out-of-bounds read vulnerability in libyal's libregf library versions up to 0. It occurs in the function libregf_value_item_read_value_data() due to improper bounds checking of value data size without accounting for a 4-byte offset. Crafted REGF hive files of version 1.0 or 1.1 can trigger this flaw, potentially leaking adjacent heap memory or causing crashes in parsers such as regfexport and plaso.

CVE-2026-111139 is an out-of-bounds read vulnerability in the NetSurf libnsbmp library up to version 0.1.7. The flaw occurs in the bmp_decode_mask() function when processing crafted ICO files with bitmap widths not divisible by 8, leading to a heap over-read by one byte. This can cause application crashes when bmp_decode() is called.

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

libsmi versions up to 0.5.0 contain an out-of-bounds write vulnerability in the smiValueAsString() function. This flaw allows an attacker to overflow a fixed 1024-byte static buffer by supplying a crafted MIB with an OCTET STRING default value of 512 or more octets starting with a 0x00 byte. The overflow can corrupt adjacent library globals and cause crashes in smidump or other consumers.

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.

CVE-2026-111135 is a heap out-of-bounds read vulnerability in libfwsi version 0, specifically in the function libfwsi_mtp_volume_values_read_data(). This flaw allows attackers to read beyond buffer boundaries by crafting MTP volume shell items embedded in .lnk files, jump lists, or shell bags. The crafted shell items range from 10 to 53 bytes with an item data size of 44 or more, potentially causing crashes in processes that consume these files. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity.

CVE-2026-111134 is a heap out-of-bounds read vulnerability in libfwsi through version 20260522. It occurs in the function libfwsi_mtp_file_entry_values_read_data() when processing crafted MTP file entry shell items embedded in .lnk files, jump lists, or shell bags. This flaw allows attackers to read memory beyond the intended buffer bounds, potentially causing crashes in applications using libfwsi.

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.

CVE-2026-111132 is a heap out-of-bounds read vulnerability in GNOME libgxps versions up to 0.3.2. It occurs in the path_geometry_start_element() function when processing crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes in XPS documents. An attacker can supply a point count not divisible by three or two, causing a read past allocated memory, potentially crashing applications like Evince and leaking adjacent heap memory.

CFITSIO versions up to 4.7.0 contain a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder. This flaw allows attackers to read beyond the compressed tile buffer by supplying a crafted FITS file with an oversized tile geometry declaration. The vulnerability can cause application crashes or limited disclosure of heap memory when processing such files.

CVE-2026-111252 is a denial of service vulnerability in OpenNMS Meridian and Horizon XML parsing. It occurs due to improper restriction of recursive entity references in DTDs, allowing an authenticated user with provisioning access to supply XML documents that cause excessive entity expansion and exhaust server memory. The vulnerability affects multiple versions prior to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5. The vendor has released fixes that cap entity expansions and reject DOCTYPE declarations in requisition and foreign-source XML. These products are intended for private network installation and not direct Internet exposure.

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.

Netgate pfSense CE versions 2.3.0 through 2.9.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with Firewall: Rules or NAT: Port Forward privileges can inject malicious scripts via the separator color field. These scripts are rendered unencoded in class attributes by the display_separator() function, allowing execution in administrators' browsers. This can lead to unauthorized WebGUI actions performed with administrator privileges. The vulnerability has a CVSS 4.8 (medium) score and requires user interaction with elevated privileges.

Netgate pfSense CE versions up to 2.9.0 have an authorization bypass vulnerability that allows read-only WebGUI users with certain page privileges to replace the configuration file (config.xml). This occurs because the functions config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Exploiting this flaw can lead to root-level code execution after a system reload or reboot.

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

pfSense CE versions 2.7.0 through 2.9.0 contain a command injection vulnerability in the captive portal high availability feature. This flaw allows users with the Captive Portal HA privilege to execute arbitrary commands as root by exploiting unescaped input passed to a shell command.

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.

Netgate pfSense CE up to version 2.9.0 has a CRLF injection vulnerability in the DNS Resolver Access Lists feature. Authenticated users with the appropriate privilege can inject configuration directives into Unbound's access_lists.conf file by embedding CR/LF characters in specific fields. This allows manipulation of DNS responses served to LAN clients.

pfSense CE versions 2.4.5 through 2.9.0 have an OS command injection vulnerability in the WebGUI Login Protection settings. Authenticated users with Advanced Admin Access can inject commands as root by submitting specially crafted values containing newlines or command substitution syntax. This vulnerability allows execution of arbitrary commands with root privileges.