CWE-121: Stack-based Buffer Overflow vulnerabilities

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory corruption and the httpd process to crash, resulting in a denial of service for the web administration service.

A stack-based buffer overflow vulnerability (CWE-121) exists in the /usr/bin/ltsudo cmd_ipaddr_conflict component of Loytec LIP-ME20xC devices running LINX-A64 through version 8.4.16. This flaw can be triggered by a user in the superadmin group by supplying an overly long interface-name argument, potentially causing a SUID-root process to abort or allowing privilege escalation. The vulnerability has a low CVSS 4.0 base score of 3.8 and requires local low-complexity access with partial privileges. No official patch or remediation guidance is currently available from the vendor.

The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request.

A critical stack-based buffer overflow vulnerability exists in Data::RingBuffer::Shared versions before 0.04 for Perl. The flaw arises from an unvalidated elem_size parameter in the ring_read_seq function, which copies data into a fixed 8-byte stack buffer without proper bounds checking. This allows an attacker with local write access to the backing file to cause stack corruption by specifying an elem_size larger than 8 bytes.

DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-16097 is a high-severity stack-based buffer overflow vulnerability in Shibby Tomato version 1.28 affecting the Scheduler Name Handler component. The vulnerability arises from improper handling of the argument 'a1' in function sub_42537C, allowing remote attackers to potentially exploit the flaw. The project Shibby Tomato has been superseded by FreshTomato. No patch or official fix information is provided.

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowing a one-byte out-of-bounds write to the stack buffer tmpTokenBuf that can cause denial of service and potentially remote code execution. This issue is fixed in version 3.4.1.14.

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-13309.

Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVIDIA Triton Inference Server for Linux contains a stack-based buffer overflow vulnerability (CWE-121) that can be exploited remotely without authentication. Successful exploitation may cause a denial of service condition. The vulnerability has a high severity score of 7.5 but does not impact confidentiality or integrity. No official patch or remediation guidance is currently available from the vendor.

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable.

Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.