CWE-787: Out-of-bounds Write vulnerabilities

Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution.

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash.

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes.

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.

Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this could lead to an incorrectly sized memory allocation and a subsequent out-of-bounds write during pixel processing, potentially resulting in remote code execution.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

CVE-2026-87121 is a critical out-of-bounds write vulnerability in the lwIP TCP/IP Stack MQTT component. This flaw allows an attacker to execute arbitrary code on affected devices without requiring privileges or user interaction. The vulnerability affects lwIP TCP/IP Stack MQTT versions from 2.0.1 through 2.2.1. It has a CVSS 3.1 base score of 9.8, indicating a high severity with network attack vector, no required privileges, and no user interaction needed.

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-95862 is an out-of-bounds write vulnerability in Ubiquiti Inc's Dream Machines UniFi gateway devices. An attacker with network access could exploit this flaw to cause a Denial of Service (DoS) condition, disrupting device availability. The vulnerability does not impact confidentiality or integrity but affects device availability. It has a CVSS v3.1 score of 7.5 (high severity).

CVE-2026-77555 is an out-of-bounds write vulnerability in Ubiquiti Inc Dream Machines UniFi gateway devices. A network attacker could exploit this flaw to cause a denial of service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability. It has a high severity with a CVSS score of 7.5. Multiple affected versions exist prior to specific fixed releases.

CVE-2026-77544 is an out-of-bounds write vulnerability in Ubiquiti Inc Dream Machines UniFi gateway devices. An attacker with network access could exploit this flaw to cause a denial of service (DoS) on the affected device. The vulnerability does not impact confidentiality or integrity but results in service disruption. It affects multiple versions prior to 4.0.21 and 5.1.26/5.1.31. No known exploits are reported in the wild. The CVSS 3.1 score is 7.5 (high severity).

CVE-2026-18460 is an off-by-one error vulnerability in RTI Connext Professional Core Libraries that allows out-of-bounds write leading to buffer overflow. It affects versions from 7.0.0 up to but not including 7.3.1.6, and from 7.4.0 up to but not including 7.7.0.1. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No known exploits are reported in the wild. No vendor patch or official fix information is provided in the available data.

An integer overflow vulnerability exists in radare2's CPython bytecode .pyc marshal parser prior to version 6.2.0. The vulnerability occurs because the parser accepts a 32-bit string length that can overflow the allocation size, leading to heap memory corruption when processing crafted .pyc files. This can cause denial of service, and while arbitrary code execution is possible, it has not been demonstrated. The issue is fixed in radare2 version 6.2.0.