CWE-119: Memory Buffer Overflow vulnerabilities

CVE-2026-54559 affects PocketSphinx, a small speech recognizer, due to improper boundary validation in language-model loaders and unbounded string usage in acoustic-model loaders. This can lead to stack or heap buffer overflows and memory corruption when loading invalid or malicious model files. The vulnerability is fixed in version 5.1.1. Users of versions prior to 5.1.1 should upgrade to mitigate this issue.

A use-after-free vulnerability exists in the cJSON library up to version 1.7.19 in the cJSONUtils_MergePatch function. This vulnerability can be exploited remotely and has a publicly available exploit. A fix has been proposed but is not yet accepted or officially released.

CVE-2026-87931 is a critical buffer overflow vulnerability in the Behavioral Technology Group Pavlok Behavioral Conditioning Wearable, specifically in an unknown function of the Apple Notification Center Service Event Handler component. The vulnerability affects versions up to and including 20260707. Exploitation requires local network access and no user interaction or privileges are needed. The vendor has not responded to the disclosure, and no patch or remediation is currently available.

A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover

CVE-2026-82623 is a use-after-free vulnerability in the open62541 library versions 1.5.0 through 1.5.5. The flaw is located in the UA_DataValue_backend_copyRange function of the History Backend component. It can be exploited remotely without authentication. The vulnerability has a CVSS score of 5.3, indicating medium severity. Exploit code is publicly available, but the project has not officially disclosed the vulnerability through its issue tracker. No patch or official fix information is provided.

A buffer overflow vulnerability exists in NASA cFS versions 7.0.0 and 7.0.1 within the OS_read function of the SBN TCP Module. The flaw arises from improper handling of the MsgSz argument, allowing local network attackers to cause memory corruption. The vulnerability has a medium severity rating with a CVSS score of 6.3. No vendor response or patch is currently available.

NASA Trick version 19.6.0 contains a stack-based buffer overflow vulnerability in the JSONVariableServerThread::parse_request function within the TCP Socket Handler component. This flaw allows remote attackers to cause memory corruption by manipulating input data. The vendor has not provided a response or patch for this issue. The vulnerability has a CVSS score of 7.3, indicating a medium severity level.

CVE-2026-81581 is a high-severity vulnerability in the WibuKey64.sys driver of WibuKey up to version 6.70 for Windows. It involves improper validation of memory boundaries, allowing an attacker to set pointers outside the intended scope. This flaw can lead to denial of service and potentially remote code execution or privilege escalation due to the driver running with system privileges. No patch or official remediation has been confirmed yet.

SumatraPDF versions 3.6.1 and earlier contain a heap memory corruption vulnerability in the CHM file parser. A crafted CHM file with malformed LZX Huffman code lengths can cause out-of-bounds writes in the decompression code, leading to heap corruption. While arbitrary code execution has not been demonstrated, the flaw poses a risk of memory corruption during parsing. No fixed version is currently available.

CVE-2026-18294 is a high-severity memory corruption vulnerability in OriginLab Origin Viewer version 9.9.5. It arises from improper validation of user-supplied data during parsing of OGW files, leading to potential remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability allows attackers to execute arbitrary code within the context of the affected process.

CVE-2026-18292 is a high-severity vulnerability in OriginLab OriginPro involving improper bounds checking during OGG file parsing. This memory corruption flaw allows remote attackers to execute arbitrary code if a user opens a crafted malicious file or visits a malicious page. Exploitation requires user interaction. No affected versions or patch information are provided.

CVE-2026-18291 is a high-severity memory corruption vulnerability in OriginLab OriginPro's OGW file parser. It arises from improper validation of user-supplied data, allowing remote attackers to execute arbitrary code by convincing a user to open a malicious file or visit a malicious page. Exploitation requires user interaction.

CVE-2026-19508 is a critical heap-based buffer overflow vulnerability in the multipart form-data parser of the RDK-B WebUI component. It affects the file jst_post.c in the specified RDK-B WebUI version. This flaw allows a remote unauthenticated attacker to cause memory corruption, denial of service, and potentially execute arbitrary code by sending a crafted multipart/form-data request.

CVE-2026-43794 is a high-severity memory corruption vulnerability affecting multiple Apple operating systems and Safari. The issue arises from improper memory handling when processing maliciously crafted web content, potentially leading to memory corruption. This vulnerability impacts confidentiality, integrity, and availability. Fixed versions include Safari 26.6.1, iOS 18.7.10 and 26.6.1, iPadOS 18.7.10 and 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27.

A memory corruption vulnerability exists in Apple Safari when processing maliciously crafted web content. This issue could lead to memory corruption, potentially impacting confidentiality and integrity. The vulnerability is fixed in Safari 26.6.1 and corresponding updates for iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The CVSS score is 5.4, indicating a medium severity level.

CVE-2026-65334 is a medium severity memory corruption vulnerability in Safari and related Apple operating systems. The flaw could cause Safari to crash when processing maliciously crafted web content. It has been fixed with improved state management in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27.

Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.