CVE-2026-116737 is a heap out-of-bounds read vulnerability in libphdi, a component of libyal. The flaw occurs in the function libphdi_data_files_get_extent_data_file_path, which incorrectly calculates buffer size by using the directory prefix length instead of the basename length. This can be triggered by a crafted Parallels disk image descriptor with a long directory prefix and a short basename, potentially causing a process crash or exposure of adjacent heap memory.
CVE-2026-116736 is a heap out-of-bounds read vulnerability in libpff up to version 20260926. The flaw occurs in the libpff_table_read_values_array function due to improper validation of a 7c column definition's values_array_size against the remaining buffer bytes. An attacker can exploit this by supplying a crafted PST, OST, or PAB file, causing applications to read adjacent heap memory or crash.
CVE-2026-116735 is an off-by-one bounds check vulnerability in libpff through version 20260926. It occurs in the function libpff_table_read_6c_record_entries and allows attackers to trigger a heap out-of-bounds read by supplying crafted PST, OST, or PAB files. This can lead to reading adjacent heap memory or application crashes in tools like pffexport or pypff.
flatcc versions up to 0.6.4 have an integer overflow vulnerability in the check_header function of the FlatBuffers verifier. On 32-bit builds, this flaw allows crafted buffer offsets to bypass bounds checks, leading to out-of-bounds reads before the buffer and potential process crashes.
CVE-2026-116733 is an out-of-bounds read vulnerability in flatcc versions up to 0.6.4. It occurs in the __flatcc_json_parser_number function when parsing JSON numbers ending with a decimal point. This flaw allows attackers to read beyond the input buffer, potentially causing application crashes.
libdwarf versions up to 2.3.3 contain a heap out-of-bounds read vulnerability in the dwarf_debug_addr_table() function. This flaw occurs because the function omits the table starting offset when validating the .debug_addr unit length. An attacker can exploit this by supplying a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read beyond the allocated heap buffer. This can lead to disclosure of adjacent heap memory or cause a crash in programs using libdwarf.
Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using a crafted FamiTracker module with a subsong count of two or more, causing a write beyond the subsong vector and potentially crashing the application when the module is opened.
Furnace versions up to 0.6.8.3 have an out-of-bounds heap read vulnerability in the DivEngine::loadFTM() function. This flaw occurs when importing FamiTracker modules with an unbounded DPCM note count, allowing crafted files to read beyond the noteMap array and cause a crash.
CVE-2026-116729 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 volumes. The flaw occurs in the function libfvde_encrypted_metadata_read_type_0x001a() due to an unbounded strlen call on embedded XML plist data that is not properly NUL-terminated. An attacker can craft a malicious FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read beyond the allocated heap buffer.
CVE-2026-116728 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 Core Storage volumes. The flaw occurs because the size of XML plist data is not properly checked against the source metadata block, allowing an attacker to cause a buffer over-read. This can lead to application crashes when processing crafted volumes.
gbsplay versions up to 0.0.103 contain a heap out-of-bounds read vulnerability in the vgm_open() function. This occurs because the function processes VGM command streams without proper bounds checking, allowing a crafted VGM file with specific wait opcodes and missing a 0x66 terminator to cause a read beyond the allocated heap buffer, potentially crashing the player.
Gbsplay versions up to 0.0.103 have a heap out-of-bounds read vulnerability in the gbr_open() function within gbs.c. This occurs because the function does not properly verify the length of the input GBR file before scanning the ROM title field. An attacker can craft a GBR file sized between 0x21 and 0x162 bytes to trigger reading beyond the allocated heap buffer, potentially causing a crash or memory leakage.
An out-of-bounds read vulnerability exists in gbsplay through version 0.0.103 in the mapper_map() function. This flaw allows crafted .gbr, .gbs, or .gb files with malicious ROM bank indexes to cause the player to read beyond the allocated heap buffer, potentially crashing the application.
FLTK versions up to 1.4.5 have an integer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw causes the application to allocate an undersized pixel buffer based on file-supplied width and height values. An attacker can exploit this by providing a crafted BMP or ICO file with large dimensions, leading to heap buffer overflow and corruption of the application heap.
FLTK versions up to and including 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when processing BMP or ICO files with a colors_used field value exceeding 256, which overflows a 768-byte colormap array. Exploitation can lead to application crashes or potentially allow code execution.
CVE-2026-116590 is a vulnerability in the xerial snappy-java library prior to version 1.1.10.9. It involves improper validation of array indices in the Snappy.arrayCopy method, which allows passing negative or oversized offset and byteLength values to native memcpy calls. This can cause out-of-bounds reads or writes, potentially crashing the Java Virtual Machine (JVM). The issue affects methods like SnappyOutputStream.rawWrite and SnappyInputStream.rawRead that use this primitive. The vulnerability is fixed in version 1.1.10.9.
CVE-2026-116514 is a cross-site scripting (XSS) vulnerability in itsourcecode Airline Reservation System version 1.0. The flaw exists in the /book_flight.php file where manipulation of the 'max' argument can lead to XSS. This vulnerability can be exploited remotely and requires user interaction. Public exploit code is available. The CVSS 4.0 base score is 5.3, indicating a medium severity.
A buffer overflow vulnerability was addressed by improving bounds checking in several Apple operating systems. The flaw could cause unexpected process termination when processing a maliciously crafted file. Fixed versions include iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2.
An authorization issue in iOS and iPadOS was addressed by improving entitlement checks. The vulnerability could allow a remote attacker to access sensitive user data. This issue is fixed in iOS 27.2 and iPadOS 27.2.
A vulnerability in Safari and related Apple operating systems was addressed by improved input validation. The flaw could cause an unexpected process crash when processing maliciously crafted web content. The issue is fixed in Safari 27.2, iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and tvOS 27.2.