CWE-787: Out-of-bounds Write vulnerabilities

CVE-2026-93393 is a critical heap-based buffer overflow vulnerability in the TLS transport layer of the MongoDB C Driver when built with the Windows TLS backend. A remote endpoint can trigger out-of-bounds writes during processing of encrypted traffic after the TLS handshake, without requiring authentication or user interaction. This can cause memory corruption, disclosure of adjacent heap memory, or process termination.

A heap buffer overflow vulnerability exists in HappySeaFox sail library versions prior to 1.0.0 in the function sail_codec_load_frame_v8_xbm(). The issue arises from incorrect buffer size calculation when decoding certain X10 static short files, leading to a forward heap overwrite that scales with image height. This can corrupt process state, cause crashes, and potentially allow code execution. The vulnerability is fixed in version 1.0.0.

A heap-based buffer overflow vulnerability exists in HappySeaFox sail versions before 1.0.0. The flaw occurs in the PSD image loading code where a mismatch between pixel format and file depth causes out-of-bounds writes when loading crafted PSD files. This can lead to memory corruption, crashes, or potential code execution. The issue is fixed in version 1.0.0.

A heap-based buffer overflow vulnerability exists in HappySeaFox sail versions prior to 1.0.0. The flaw occurs when loading crafted color-mapped run-length-encoded TGA images, where the pixel buffer allocation does not match the attacker-controlled pixel size derived from the image header. This mismatch allows writing beyond the allocated heap buffer, potentially causing heap corruption, crashes, or code execution. The issue is an incomplete fix of a previous vulnerability (CVE-2026-40494) and has been resolved in version 1.0.0.

CVE-2026-25280 is a high-severity vulnerability in Qualcomm Snapdragon products involving an out-of-bounds write due to memory corruption when processing escape handling with insufficient user buffer sizes. It affects specific Snapdragon versions identified by their model numbers. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the input data.

CVE-2026-24074 is a high-severity vulnerability in Qualcomm Snapdragon products caused by an out-of-bounds write. It occurs when processing data with large offset and length values that exceed buffer limits during data copy operations, leading to memory corruption.

CVE-2026-24073 is a high-severity vulnerability in Qualcomm Snapdragon devices involving an out-of-bounds write due to insufficient validation of an offset against a structure size during decode statistics processing. This memory corruption flaw can impact confidentiality, integrity, and availability of affected devices. The affected versions include specific Qualcomm Snapdragon components identified by model numbers IQX5121, IQX7181, QCA0000, WCD9380, WCD9385, WSA8840, and WSA8845. No patch or remediation information is provided in the available data.

CVE-2026-91097 is a high-severity vulnerability in HP Linux Imaging and Printing Software (HPLIP) involving an out-of-bounds write (CWE-787). This flaw affects versions prior to 3.26.6 and could allow remote attackers to cause denial of service, escalate privileges, execute code remotely, disclose information, or modify files without authorization under certain conditions. HP has identified and remediated this and other vulnerabilities in HPLIP. No known exploits are reported in the wild at this time.

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.

CVE-2026-92177 is a high-severity vulnerability in pdfforge PDF Architect version 9.1.83.23106. It is an out-of-bounds write flaw in the PDF file parsing component that can lead to remote code execution. Exploitation requires user interaction, such as opening a malicious PDF file or visiting a malicious webpage. The vulnerability arises from improper validation of user-supplied data, allowing writes beyond allocated memory. This can enable attackers to execute arbitrary code with the privileges of the current process.

CVE-2026-92179 is a high-severity vulnerability in pdfforge PDF Architect version 9.1.83.23106. It involves an out-of-bounds write during PDF file parsing, which can be exploited by a remote attacker if the user opens a malicious PDF or visits a malicious page. Successful exploitation allows arbitrary code execution within the context of the current process. User interaction is required for exploitation.

CVE-2026-19885 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5. It involves an out-of-bounds write during the parsing of OGWU files, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction.

CVE-2026-11728 is a high-severity vulnerability in IBM MQ affecting multiple versions including 9.1.0.0, 9.2.0.0, 9.3.0.0, 9.4.0.0, and 10.0.0.0. It involves a heap buffer overflow caused by an out-of-bounds write when the client receives messages from a malicious queue manager or via a man-in-the-middle attack. This flaw could allow a remote attacker to cause denial of service or potentially execute arbitrary code on the client.

IBM Verify Identity Access is vulnerable to a buffer overflow attack.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of service (DoS).

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds array access vulnerability in the error-handling path leads to memory corruption.