CWE-787: Out-of-bounds Write vulnerabilities

CVE-2026-69050 is an out-of-bounds memory access vulnerability in the Samsung Semiconductor Exynos 1480 device driver caused by improper resource state tracking. This flaw could potentially lead to memory corruption. A fix was released in November 2026.

CVE-2026-77372 is a high-severity out-of-bounds read vulnerability in VeraCrypt versions prior to 1.26.30 affecting Unix, macOS, and FreeBSD platforms. The flaw arises from improper handling of untrusted length and count values during deserialization in certain source files, leading to heap overflow and potential memory exhaustion. This vulnerability impacts local defense-in-depth boundaries rather than remote attack surfaces and is fixed in version 1.26.30.

CVE-2026-55368 is a high-severity out-of-bounds write vulnerability in the h2o HTTP server's access-log formatter. The flaw occurs when certain custom access-log formats are configured, allowing writes past the log-line buffer. This can cause server crashes or potentially other undefined behavior due to a one-byte null byte overwrite. The vulnerability is fixed in a specific commit identified by the vendor.

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.

A vulnerability in Git for Windows versions from 2.43.0.windows.1 up to but not including 2.55.0.windows.3 allows an out-of-bounds write in the git-credential-wincred helper. This occurs when erasing a credential with a password field present, causing a buffer overflow by writing a two-byte NUL past the allocated buffer. The issue can lead to Windows heap corruption and failure to properly delete credentials, although the operation may appear successful. The flaw is fixed in version 2.55.0.windows.3.

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.

An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.

Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet. Refer to the '  Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.

An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline, potentially resulting in heap corruption or denial of service (DoS).

Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS

Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS