Threats affecting pkg:generic/espeak-ng

fastapi-code-generator versions prior to 0.8.1 contain a critical vulnerability where the OpenAPI path is injected into the generated FastAPI route decorator without proper escaping. This allows an attacker to craft a path containing a single quote that breaks out of the string literal and injects arbitrary Python code executed at import time, leading to remote code execution without any request needed.

fastapi-code-generator versions prior to 0.8.1 contain a critical import-time remote code execution vulnerability. This occurs because the tool emits response status-code keys into the FastAPI route decorator's responses dictionary as unescaped single-quoted string literals. An attacker-controlled status-code key containing a single quote can break out of the string context and inject arbitrary Python expressions that execute during module import, before any request is made. This affects applications generating FastAPI code from attacker-influenced OpenAPI specs with multiple responses. The vulnerability is fixed in version 0.8.1 by properly escaping status-code keys and validating their format.

CVE-2026-124987 is a medium severity vulnerability in mikefarah yq versions 4.53.0 through 4.53.3. It involves improper escaping of output in the Encode function of pkg/yqlib/encoder_properties.go, which can be exploited remotely. A fix has been proposed but not yet accepted.

Temporal Server versions up to 1.29.7, and certain 1.30.x and 1.31.x releases, contain an authorization bypass vulnerability in workflow-history pagination. The server does not bind pagination tokens to the namespace and workflow named in the request, allowing an authenticated caller with read permission on one namespace to access workflow history from another namespace if the history shard matches. This flaw is due to unauthenticated pagination tokens lacking namespace or workflow identity binding. Fixed versions add validation checks and logging to detect and prevent this bypass.

CVE-2026-124834 is an information disclosure vulnerability in iomad affecting versions 4.5.0 through 4.5.15 and 5.0.0 through 5.0.3. The flaw exists in the store_temporary_password function of the Password Field Handler component, potentially allowing remote attackers to access sensitive information. Exploitation requires a high level of complexity and is considered difficult. A patch has been identified to address this issue.

CVE-2026-125270 is a heap out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the v4l2_buffer_swframe_to_buf() function when handling frames with a negative linesize. Maliciously crafted bottom-up AVI or PNM/PFM files can trigger this flaw during transcoding to a V4L2 M2M encoder, potentially causing application crashes or leaking heap memory into the encoded output.

A double free vulnerability exists in FFmpeg versions up to 9.0.2 in the libavcodec/cbs_sei.c component. The function cbs_sei_delete_message() leaves a stale reference that is later reused by ff_cbs_sei_add_message(), leading to heap memory corruption when processing crafted H.264 streams with specific SEI messages.

CVE-2026-125268 is a medium severity vulnerability in FFmpeg up to version 9.0.2 involving uninitialized memory disclosure in the CineForm HD decoder. An attacker can craft a CFHD file with a manipulated ImageHeight tag to cause uninitialized heap memory to leak into the decoded video output.

CVE-2026-125267 is a heap out-of-bounds write vulnerability in FFmpeg's APAC decoder caused by an integer overflow due to an unreset bitstream index. This flaw affects FFmpeg versions before 8.1.3 and 9.x before 9.0.2. An attacker can craft a malicious APAC file that triggers the overflow, leading to heap corruption or application crashes.

CVE-2026-125266 is a medium severity vulnerability in FFmpeg versions 8.0 through 9.0.2. It involves an uninitialized stack memory disclosure in the old_codec23() function of libavcodec/sanm.c. This flaw allows attackers to leak stack bytes into decoded video frames by supplying a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table.

CVE-2026-125265 is a use-after-free vulnerability in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/nvdec.c component where ff_nvdec_start_frame() does not properly reset a context pointer after slice errors. This flaw allows crafted video input to cause cuvidDecodePicture() to access freed heap memory, potentially crashing applications or exposing stale memory contents.

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc_count, making the parser loop excessively and exhaust CPU.

FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get_buffer2() allocations and exhaust memory.

CVE-2026-125262 is a heap buffer overflow vulnerability in FFmpeg versions 7.1 through 9.0.2. It occurs in the LCEVC decoder component when output picture dimensions are not properly validated against the allocated frame size. Crafted LCEVC enhancement data embedded in H.264 or HEVC streams can trigger heap corruption during decoding.

CVE-2026-125261 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the SGI encoder's encode_frame() function due to improper handling of negative linesize frames, allowing crafted video input to cause the process to read memory outside the intended frame and crash.

FFmpeg versions up to 9.0.2 contain a heap-based buffer overflow vulnerability in the libavcodec/exrenc.c component. This flaw occurs when the encode_scanline_rle() function processes frames taller than the encoder height, allowing crafted input with a resolution that grows mid-stream to corrupt heap memory. The vulnerability can cause application crashes by writing pointers beyond the scanline array during OpenEXR encoding with RLE compression.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the ProRes encoder initialization function. This flaw causes incorrect calculation of a frame size upper bound using 32-bit arithmetic for large video frames. An attacker can exploit this by supplying a high-resolution video encoded with the prores_ks encoder, leading to heap memory corruption due to buffer overflow during encoding.

FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

An off-by-one heap overflow vulnerability exists in FFmpeg versions up to 9.0.2 in the get_exponent_dynamic() function within libavcodec/nellymoserenc.c. This flaw allows an attacker to write one element past allocated memory when encoding Nellymoser audio with trellis enabled, potentially overwriting adjacent heap memory.

CVE-2026-125256 is a heap buffer overflow vulnerability in FFmpeg versions 7.0 through 9.0.2. It occurs in the ff_llvidenc_diff_bytes_rvv() function of the Huffyuv encoder on RVV-enabled RISC-V builds. The flaw allows attackers to corrupt heap memory by supplying RGB video narrower than 8 or 16 pixels, causing out-of-bounds writes past the encoder's temporary buffer.