CWE-122: Heap-based Buffer Overflow vulnerabilities

CVE-2026-93536 is a heap-based buffer overflow vulnerability in X.Org X Server and XWayland caused by a use-after-free issue in the GestureBuildSprite() function. This flaw affects versions of X.Org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this vulnerability to crash the X server or potentially execute arbitrary code.

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

USB Test versions prior to 1.1.5 contain a heap-based buffer overflow vulnerability due to improper validation of sector size returned by a system call. A malicious USB device can exploit this flaw by reporting a sector size smaller than expected, leading to out-of-bounds writes or a divide-by-zero error, causing application crashes or potential arbitrary code execution. This vulnerability is fixed in version 1.1.5.

CVE-2026-47235 is a heap-based buffer overflow vulnerability in SimulationCraft's simc tool affecting builds after release-820-01 and before a May 7, 2026 nightly build. The flaw arises from improper bounds checking on a JSON sockets array, leading to out-of-bounds writes that corrupt adjacent memory. This can cause crashes and potentially allow code execution. Attack vectors include malicious .simc profiles, compromised addon exports, or manipulated Battle.net API responses. A fix is included in the nightly build simc-1205-01-516b5d7, but no official release tag contains the patch yet.

CVE-2026-93521 is a heap-based buffer overflow vulnerability in the RandR ChangeProviderProperty requests of X.Org X Server and XWayland. It affects versions of X.Org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or execute arbitrary code within its context.

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain a heap-based buffer overflow vulnerability (CWE-122). This flaw can be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.

CVE-2026-57198 is a heap-based buffer overflow vulnerability in the Asterisk open source telephony toolkit. It affects deployments where the deprecated chan_sip channel driver is installed and its textsupport option is enabled. An authenticated attacker can exploit this flaw by sending crafted T.140 RED packets, potentially causing remote code execution or crashing the system. The vulnerability is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding certified releases. The chan_sip driver was removed in versions after Asterisk 20, so later versions without this driver are not affected.

CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted audio file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. The issue is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11, 22.8-cert3.

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

CVE-2026-109089 is a heap-based buffer overflow vulnerability in the X.Org libXi library before version 1.8.4. The flaw occurs when handling the DEVICE_RESOLUTION property and can be triggered by a malicious X server. This vulnerability allows an attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution.

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

CVE-2026-82120 is a critical heap-based buffer overflow vulnerability affecting Hitachi HiRDB Server versions 9 and 10. The flaw exists in multiple versions prior to 10-12-01 and can lead to complete compromise of confidentiality, integrity, and availability. A fix is available in version 10-12-01.

CVE-2026-76939 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It affects versions from 11-00 up to but not including 13-50-31. The flaw allows an attacker to execute arbitrary code or cause a denial of service due to memory corruption. A fix is available in version 13-50-31.

CVE-2026-76937 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This flaw allows an unauthenticated attacker to execute code remotely with high impact on confidentiality and integrity, and a lower impact on availability. A fix is available in version 13-50-31.