FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root.
The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.
Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
CVE-2026-25283 is a high-severity stack-based buffer overflow vulnerability in Qualcomm Snapdragon devices WSA8840 and WSA8845. The flaw arises from memory corruption caused by copying unverified external data exceeding the allocated buffer size. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-81546 is a stack-based buffer overflow vulnerability in the Affinity by Canva application prior to version 3.3.0. The vulnerability arises from inadequate bounds checking when parsing Affinity document files. An attacker could craft a malicious document that, when opened by a user, may lead to arbitrary code execution. This vulnerability has a high severity rating with a CVSS score of 7.7.
CVE-2026-86358 is a stack-based buffer overflow vulnerability in Dell Update Package Framework versions prior to 26.7.3. It can be exploited by an unauthenticated attacker with adjacent network access, potentially leading to remote execution. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or vendor advisory details are provided in the input data.
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and potentially affect memory contents due to improper validation of deeply nested certificate data during TLS certificate processing.
Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations.
This issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39.
CVE-2026-54559 affects PocketSphinx, a small speech recognizer, due to improper boundary validation in language-model loaders and unbounded string usage in acoustic-model loaders. This can lead to stack or heap buffer overflows and memory corruption when loading invalid or malicious model files. The vulnerability is fixed in version 5.1.1. Users of versions prior to 5.1.1 should upgrade to mitigate this issue.
A stack-based buffer overflow vulnerability exists in the GNU C Library (glibc) versions 2.1 through 2.44 in the tdelete function. This occurs when deleting nodes in a sufficiently deep binary tree, causing writes past the end of a stack-allocated array. Exploitation requires a very large tree with at least a million nodes, making it difficult to trigger. The overflow writes a pointer value that is not attacker-controlled, and no affected applications in common distributions have been identified.
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.
In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges.
Multiple stack and heap buffer overflow vulnerabilities exist in tesseract-ocr version 5.5.3 and earlier. These include a stack-based buffer overflow in Classify::ReadNormProtos, heap out-of-bounds read/write in FullyConnected::DeSerialize, unchecked heap writes in LSTM layers, and other memory corruption issues during parsing of crafted .traineddata files. These flaws can lead to denial of service, crashes, heap corruption, information disclosure, or potentially control-flow hijacking. No fixed releases are available as of the latest review.
CVE-2026-42805 is a stack-based buffer overflow vulnerability in the Bosch Sensortec BHI385 SensorAPI C library. The flaw exists in the debug message parser function, which copies an attacker-controlled message length into a fixed-size stack buffer without proper bounds checking. This can lead to memory corruption, causing firmware crashes, denial of service, or potentially arbitrary code execution.
CVE-2026-42804 is a stack-based buffer overflow vulnerability in the Bosch Sensortec BHI360 SensorAPI C-Library versions 2.1.0 through 2.2.0. The flaw occurs in the FIFO parsing and debug logging function bhi360_parse_debug_message(), which copies a length-specified payload into a fixed 17-byte stack buffer without bounds checking. An attacker with local or physical access can exploit this by sending a crafted debug frame with a length byte exceeding 16, leading to stack corruption and potential arbitrary code execution or denial of service via format string injection.
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.