The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
CVE-2026-106177 is a heap-based buffer overflow vulnerability in HP Sure Click Enterprise versions prior to 4.4.33. This flaw exists in the kernel component and may allow a local attacker with high privileges to escalate privileges further or execute arbitrary code. HP has released version 4.4.33 to address this issue. The vulnerability has a CVSS 3.1 score of 6.4, indicating medium severity.
IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a heap-based buffer overflow vulnerability due to improper bounds checking. This flaw allows an unauthenticated remote attacker to overflow the buffer and execute arbitrary code on the affected system. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-14888 is a heap-based buffer overflow vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This flaw could allow a remote attacker to execute arbitrary code on affected systems. The vulnerability has a high severity rating with a CVSS score of 8.1. No information about available patches or vendor advisories is provided in the input data.
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct.
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.
CVE-2026-106547 is a heap-based buffer overflow vulnerability in the HDF5 library before version 2.2.0. It occurs in the H5VM_array_fill() function when reading unallocated chunks of a dataset with inconsistent metadata, allowing writes beyond the allocated buffer size. This flaw can cause application crashes and potentially arbitrary code execution when processing crafted HDF5 files.
GNU Aspell's prezip-bin component contains a heap-based buffer overflow vulnerability in its decompressor due to improper buffer space checks. This flaw allows crafted compressed files to cause out-of-bounds read and write operations on the heap, potentially leading to process crashes. The issue is fixed in version 0.60.8.3.
CVE-2026-83632 is a critical vulnerability in Apache Thrift before version 0.25.0 involving allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow. This flaw can lead to severe impacts including potential denial of service or arbitrary code execution. The issue is fixed in Apache Thrift version 0.25.0. Users should upgrade to this version to mitigate the risk.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
A critical heap-based buffer overflow vulnerability exists in esnet iperf3 versions 3.20 and 3.21. The flaw occurs in the decrypt_rsa_message() function, where a 256-byte RSA buffer is read with an attacker-controlled ciphertext length, allowing an unauthenticated client to overflow the heap using an oversized authtoken. This vulnerability has been fixed in version 3.22.
CVE-2026-84268 is a heap-based buffer overflow vulnerability in the GNOME gvfs component, specifically in the SFTP protocol handling function read_reply(). This vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability. The issue affects Red Hat Enterprise Linux 8 and related distributions. A security update addressing this vulnerability is available from Red Hat.
A heap-based buffer overflow vulnerability exists in TeamViewer Full Client and Host for Linux and macOS versions 15.70 up to but not including 15.82. The flaw occurs during the processing of .tvs session recording files due to a size mismatch in decompression, which can lead to out-of-bounds heap writes. An attacker who convinces a user to open a specially crafted session recording file via the "Play or convert recorded session…" feature could achieve arbitrary code execution with the current user's privileges.
A heap-based buffer overflow vulnerability exists in the RF4CE protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability requires local access with low complexity and user interaction, and it does not impact confidentiality or integrity.
A heap-based buffer overflow vulnerability exists in the IEEE 802.11 protocol dissector of Wireshark versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.8. This flaw can cause the application to crash, resulting in a denial of service condition.
A heap-based buffer overflow vulnerability exists in the CSN.1 protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A heap-based buffer overflow vulnerability exists in the SCTP protocol dissector of Wireshark versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.8. This flaw can cause the application to crash, resulting in a denial of service condition.