CWE-787: Out-of-bounds Write vulnerabilities

An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.

An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. An out-of-bounds memory access vulnerability in the camera GDC driver may lead to kernel memory corruption under certain conditions.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.

Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

CVE-2026-45770 affects Suricata versions 8.0.0 up to but not including 8.0.5. A vulnerability exists where a Lua rule registering too many flow variables can corrupt the Lua detection state and bypass Suricata's restricted Lua sandbox. This may also cause Suricata to crash. The issue requires an affected Lua script or rule to be loaded. Version 8.0.5 includes a fix, and disabling 'security.lua.allow-rules' is a recommended workaround if Lua rules are not needed.

CVE-2026-88052 is a high-severity vulnerability in the open source OCR engine tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of an array index in the UNICHARSET::load_via_fgets function, where an unchecked index can lead to out-of-bounds writes during initialization. This can cause heap corruption, crashes, or potentially controlled memory corruption. No official fix or patched release is available as of the latest review.

CVE-2026-88051 is a high severity heap out-of-bounds write vulnerability in tesseract-ocr versions 5.5.3 and earlier. It arises from improper handling of the GenericVector::read callback in the OCR engine's .traineddata model parsing, allowing a crafted input to cause heap corruption or crashes. No official fix is available as of the latest review.

CVE-2026-88053 is a high-severity heap out-of-bounds write vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw occurs in the Classify::ReadIntTemplates function when processing crafted .traineddata files, where certain counts are used as loop bounds without proper validation. This can lead to heap corruption, crashes, or potentially controlled memory corruption during legacy-classifier initialization before OCR processing starts. No official fix or patch is available as of the latest review.

CVE-2026-88048 is a high-severity vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of deserialized layer scalars in the FullyConnected::DeSerialize function, leading to inconsistent dimensions used during matrix operations. This can cause heap out-of-bounds reads and writes, resulting in heap corruption, crashes, information disclosure, or potentially controlled memory corruption. No official fix or patch is available as of the latest review.

CVE-2026-88050 is an out-of-bounds write vulnerability in the tesseract-ocr engine versions 5.5.3 and earlier. It arises from improper handling of negative code values in the RecodedCharID::DeSerialize function, leading to an invalid index used in a size-zero vector. This causes a wild-address memory write that can crash the application or cause allocation failures. No official fix or patch is available as of the latest review.

CVE-2026-88049 is a high-severity heap out-of-bounds write vulnerability in the open source OCR engine tesseract, affecting version 5.5.3 and earlier. The flaw arises from insufficient bounds checking in certain functions handling LSTM network data, allowing a crafted NT_LSTM layer to cause heap corruption during recognition. This can lead to crashes or potentially controlled memory corruption. No official fix or patch is available as of the latest review.

CVE-2026-0310 is a buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software. It allows an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. The vulnerability also impacts Panorama. Restricting management interface access to trusted internal IP addresses reduces risk. Fixed versions are available.

An out-of-bounds write vulnerability exists in the libsavscmn.so component of devices running versions prior to One UI 8.5. This flaw allows local attackers to execute arbitrary code. The vulnerability is rated as medium severity. There are no known exploits in the wild and no patch or remediation information is currently available.

CVE-2026-21107 is an out-of-bounds write vulnerability in Samsung Notes versions prior to 4.4.45.5. This flaw allows local attackers with limited privileges to write memory outside the intended bounds, potentially leading to integrity issues. The vulnerability does not impact confidentiality or availability. It has a medium severity rating with a CVSS score of 5.5.

CVE-2026-21111 is an out-of-bounds write vulnerability in the libsthmbc.so library affecting versions prior to One UI 8.5. It allows local attackers to write outside intended memory boundaries. The vulnerability has a moderate severity rating. No known exploits or patch information are currently available.

An out-of-bounds write vulnerability exists in libsaviextractor.so prior to SMR Sep-2026 Release 1. This flaw allows local attackers with low privileges to write memory outside intended bounds, potentially causing memory corruption. No known exploits are reported in the wild. The severity is assessed as medium based on available information.