Fraunhofer HHI VVdeC versions up to 3.2.1 have a heap out-of-bounds read vulnerability. This flaw occurs when a crafted VVC bitstream with a collocated picture of a different resolution is processed, causing the decoder to read beyond allocated memory during error concealment. The vulnerability can lead to a crash of the decoder.
Fraunhofer HHI VVdeC versions up to 3.2.1 have a NULL pointer dereference vulnerability in the InterPrediction::xPredInterBlk function. This flaw can be triggered by a crafted VVC bitstream that switches the SPS to enable reference wrap-around, causing the decoder to read from missing buffers and crash. The vulnerability leads to denial of service by crashing the decoder.
Fraunhofer HHI VVdeC versions before 3.2.1 contain an out-of-bounds read vulnerability. This flaw allows attackers to crash the decoder by crafting bitstreams with overlapping slice CTU coverage, causing a negative reference index access during decoding. The issue is fixed in version 3.2.1.
Fraunhofer HHI VVdeC versions before 3.2.1 have a heap out-of-bounds read vulnerability in the SEIReader::xParseSEIScalableNesting function. This flaw allows attackers to read memory beyond allocated heap buffers by miscasting SEI wrapper objects. A crafted VVC bitstream with specific nested SEI messages can trigger this issue, potentially causing a crash or unauthorized memory disclosure.
Fraunhofer HHI VVdeC versions before 3.2.1 have a heap use-after-free vulnerability in the DecLibRecon::createSubPicRefBufs function. This occurs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks, which can lead to heap memory corruption or a decoder crash when processing crafted multi-subpicture VVC bitstreams with two or more threads.
Fraunhofer HHI VVdeC versions before 3.2.1 contain a heap use-after-free vulnerability. This flaw arises when an ALF adaptation parameter set ID is redefined while still referenced by slices, leading to memory corruption. The vulnerability can be triggered by a crafted VVC bitstream during multithreaded decoding, causing worker threads to dereference freed APS objects. This results in crashes or heap corruption.
A use-after-free vulnerability was identified and fixed in the Linux kernel's net/sched sch_teql module. The flaw occurs when the teql_master_xmit() function incorrectly handles the return value of a slave's ndo_start_xmit(), leading to a use-after-free condition if the lower qdisc drops a packet. This issue affects Linux kernel version 2.6.33. The fix involves properly testing for packet consumption to avoid accessing freed memory.
This vulnerability in the Linux kernel involves the tun (network TUN/TAP) device driver. It fixes a security issue where attaching to a persistent tun device without an assigned owner or group did not require the CAP_NET_ADMIN capability, allowing unauthorized access. The fix enforces that attaching to such ownerless devices now requires CAP_NET_ADMIN, closing this loophole while preserving existing ownership and permission models.
A vulnerability in the Linux kernel's ksmbd component involves improper handling of session procfs readers during session cleanup. This flaw can lead to use-after-free conditions when session table references are dropped while procfs entries are still accessible. The issue is addressed by ensuring procfs entries are removed before dropping table references and properly draining procfs readers during connection cleanup.
A vulnerability in the Linux kernel's ksmbd component related to session management has been resolved. The issue involved ended sessions retaining memory and connection slots after logoff or expiration, potentially leading to resource retention. The fix ensures proper reclamation and cleanup of these sessions, including unlinking from connections and removing procfs entries to prevent stale session data. This addresses potential resource exhaustion or session management inconsistencies.
A vulnerability in the Linux kernel's ksmbd component allowed clients to create an unbounded number of valid SMB sessions on a single connection by repeatedly completing authentication. This was due to the pending setup limit only counting sessions in progress, not valid sessions. The issue has been fixed by reserving connection slots before session allocation and enforcing a maximum sessions per connection limit, defaulting to 64. The fix is included in Linux kernel version 7.3 and specific commits.
A use-after-free vulnerability in the Linux kernel's ksmbd component related to session channel connection references has been resolved. The flaw allowed a connection to be freed while still accessed by another session reference holder, potentially causing instability during SMB3.1.1 binding or procfs reads. The fix involves holding a connection reference for each session channel until the session is fully destroyed.
CVE-2026-99276 is a vulnerability in the Linux kernel's ksmbd component related to connection scavenging and session lock handling. The issue involves a deadlock scenario where the expiration worker holds a read lock on conn_list_lock while waiting for session locks that are held by a writer queued on the same conn_list_lock. This can cause the worker to block indefinitely. The fix defers connection scavenging when session locks are busy, allowing the worker to retry later instead of waiting and causing a deadlock.
A vulnerability in the Linux kernel SMB client allows acceptance of short SESSION_SETUP responses that are too small to contain required fields. This leads to reading stale buffer data and copying up to about 64 KB of memory beyond the intended buffer, which is then sent back to the server during NTLMv2 authentication. The issue affects all supported stable Linux kernel trees and was reproduced on version 6.6.87.2. The vulnerability has been fixed in specific commits.
A vulnerability in the Linux kernel SMB client was fixed to prevent a wild read caused by an empty truncated response from a malicious SMB2 server. The issue occurs when smb3_fiemap() mishandles an empty response with STATUS_BUFFER_OVERFLOW and OutputCount == 0, leading to an out-of-bounds read. The fix rejects empty truncated range blobs and ensures proper offset calculations to prevent infinite loops or crashes.
A vulnerability in the Linux kernel's ksmbd component involves insufficient space allocation for a UTF-16 terminator in stream information. The function smb_strtoUTF16() writes a terminating zero UTF-16 unit after converted characters, but the buffer allocation in get_file_stream_info() does not reserve space for this terminator. This causes the terminator to be written two bytes beyond the allocated buffer when the entry exactly fills the 448-byte small response buffer. The issue has been fixed by reserving one extra UTF-16 unit in the buffer allocation checks. The terminator is not part of the wire format, so reported lengths remain unchanged.
A vulnerability in the Linux kernel SMB client implementation in SMB2_read() allows a malicious SMB server to cause out-of-bounds memory reads by sending a crafted READ response with inconsistent DataOffset and DataLength values. This flaw can lead to copying more data than the actual response size, potentially causing memory corruption or information disclosure. The issue has been fixed by validating and clamping the DataOffset and ensuring the total read length fits within the received response buffer.
A use-after-free vulnerability in the Linux kernel ALSA line6 driver was fixed by clearing a stale pointer on capture buffer release. The issue involved a slab-use-after-free read in submit_audio_out_urb() when generating an impulse test signal, caused by not clearing the prev_fbuf pointer after freeing the capture buffer. This could lead to dereferencing freed memory during playback startup.
CVE-2026-123988 is a vulnerability in the SililaWijesinghe Food Ordering System that allows remote attackers to obtain sensitive information via directory listing in the /Food-Ordering-System/admin/ directory. The product does not use versioning, so affected versions cannot be precisely identified. The vendor was notified but did not respond or provide a fix. Public exploit details are available, but no known exploitation in the wild has been reported.
A malicious file identified by the SHA-256 hash cf0b50b8b7a861c3490889683d857e50b54d0e4975678d58778bba800b589db8 was observed twice on 2026-11-07 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was traced to Poland and Romania. This indicator should be matched against files in environments and security tools to detect potential compromise.