CWE-787: Out-of-bounds Write vulnerabilities

CVE-2026-47530 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves an out-of-bounds write in the kernel mode layer. Exploitation could allow an attacker with limited privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data.

CVE-2026-47523 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves an out-of-bounds write in the kernel mode layer. Exploitation could allow attackers to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data.

CVE-2026-47511 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves an out-of-bounds write in the kernel mode layer that could be exploited by a user with limited privileges. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-47501 is a high-severity vulnerability in the NVIDIA GPU Display Driver for Linux. It involves an out-of-bounds write in the kernel mode layer triggered by supplying mismatched memory buffers during event buffer setup. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-103111 is a high-severity vulnerability in PCRE2 versions before 10.49. It involves an out-of-bounds write triggered by attacker-controlled regular expressions combined with specific JIT API usage. This flaw can lead to arbitrary data being written out-of-bounds, affecting integrity and potentially availability.

CVE-2026-103110 is a critical out-of-bounds write vulnerability in Pexip Infinity conferencing software. It affects versions before 38.2, as well as versions 39.0, 39.1, and 40.0. The flaw allows a remote attacker to execute arbitrary code remotely as an unprivileged user on a Pexip Infinity Conferencing Node without requiring user interaction or privileges.

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption.

CVE-2026-81433 is a high-severity stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd). It allows an unauthenticated attacker with adjacent network access to execute arbitrary code or cause a denial of service by crashing the process via a specially crafted DHCP packet. Fixed versions are available.

CVE-2026-102730 is a high-severity vulnerability in Eclipse Foundation's Eclipse ThreadX NetX Duo involving an out-of-bounds heap write triggered by mounting a malicious NAND flash image. This flaw occurs in LevelX's NAND flash-translation-layer metadata parser and allows overwriting a driver function pointer, enabling control-flow hijacking with an attacker-controlled instruction pointer. The issue has been demonstrated with AddressSanitizer and includes additional out-of-bounds reads. No affected versions or patches are explicitly stated.

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

CVE-2026-102715 is a high-severity out-of-bounds write vulnerability in Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603. The flaw exists in the mDNS add-on's string cache, which incorrectly accepts a shorter name as a match for a longer stored name. This can cause a device performing continuous service discovery to write up to three bytes beyond its transmit packet, potentially corrupting adjacent packets or the memory pool's free list and misattributing discovered records.

CVE-2026-102761 is a critical out-of-bounds write vulnerability in the Eclipse Foundation's NetX Duo WebSocket client. The flaw arises because the unmasking cursor resets incorrectly when processing chained packets, causing an XOR loop to write attacker-controlled data beyond intended memory boundaries. This vulnerability affects versions 6.2.0 through 6.5.1.202602 of NetX Duo.

CVE-2026-102757 is a high-severity vulnerability in the Eclipse Foundation's ThreadX real-time operating system. It allows an unprivileged, memory-protected module to manipulate kernel memory in privileged mode, bypassing isolation boundaries by clearing the MPU enable bit. This occurs due to improper validation in the Module Manager's object dereference logic, enabling an attacker to craft addresses that pass checks incorrectly and gain privileged memory access.

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVE-2026-102004 is a high-severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves an out-of-bounds write caused by specific system call arguments leading to memory corruption in the memory management subsystem. This flaw can result in confidentiality, integrity, and availability impacts. The issue has been fixed in version 26.09.

CVE-2026-80431 is an out-of-bounds write vulnerability in the kitty terminal emulator affecting versions from 0.40.0 up to but not including 0.49.0. The flaw occurs in the text sizing protocol when processing certain grapheme clusters longer than four codepoints in OSC 66 escape codes, leading to writes beyond a fixed-size buffer. This can cause the kitty process to terminate, closing all its windows, tabs, and child processes. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.8.

CVE-2026-87118 is an out-of-bounds write vulnerability in the command processing functionality of Botslab G980H dash camera firmware. An authenticated attacker with adjacent network access can exploit this flaw by submitting crafted command data that corrupts memory. This corruption may disrupt the authentication state or cause the affected process to terminate and the device to restart, leading to a temporary denial of service. The vulnerability affects specific firmware versions =30010_QHG980HN5294SysFW+ and =58_QHG980HMCN5291SysFW+.

CVE-2026-96746 is a high-severity vulnerability in the MongoDB C Driver involving an out-of-bounds write in the connection-monitoring logic. An unauthenticated attacker who can control DNS resolution and responses for hosts in a client's connection string may exploit this to write beyond the end of a heap buffer, potentially causing the application to crash unexpectedly.