CWE-122: Heap-based Buffer Overflow vulnerabilities

A heap-based buffer overflow vulnerability exists in the Sharkd utility of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This flaw can cause the utility to crash, resulting in a denial of service condition. The vulnerability requires local access with user interaction to be exploited and does not impact confidentiality or integrity.

CVE-2026-95387 is a heap-based buffer overflow vulnerability in the SPDY protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The flaw has a high severity with a CVSS score of 8.1. No known exploits are reported in the wild. No patch or official fix information is provided in the available data.

A heap-based buffer overflow vulnerability exists in the X11 protocol dissector of Wireshark versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.8. This flaw can cause the application to crash, resulting in a denial of service condition. The issue is fixed in versions 4.4.19 and 4.6.9.

CVE-2026-92842 is a medium severity heap-based buffer overflow vulnerability in PHP related to the convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters. The issue arises because the filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value using pestrdup(), which stops at the first NUL byte but retains the original length. This discrepancy allows the filter to read past the allocated buffer when emitting a line break, potentially leaking adjacent heap memory into the output.

A heap-based buffer overflow vulnerability exists in PHP's OpenSSL extension function php_openssl_matches_wildcard_name(). This occurs when a TLS server certificate presents a wildcard name whose literal characters are longer than the hostname being verified, causing an underflow in the length argument passed to memchr(). This can lead to reading memory beyond the allocated heap buffer. The vulnerability is reachable from any default PHP client stream since verify_peer_name is enabled by default.

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

CVE-2026-100208 is an integer overflow or wraparound vulnerability in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions 16.0.0 and 16.0.1 of the software. An official fix is available from Microsoft, and the vendor manages remediation for this cloud-hosted service. There are no known exploits in the wild at this time.

CVE-2026-70125 is a heap-based buffer overflow vulnerability in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code locally on the affected system. The vulnerability affects versions 16.0.0 and 16.0.1. It has a high severity score of 7.8 according to CVSS 3.1. An official fix is available from Microsoft, and the vendor manages remediation for this cloud-hosted service. There are no known exploits in the wild at this time.

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-18457 is a heap-based buffer overflow vulnerability in RTI Connext Professional Core Libraries. It affects multiple versions ranging from 5.2.3 up to but not including 7.7.0.1. The vulnerability allows buffer overflow conditions that could be exploited to impact the integrity and availability of the affected software. The CVSS 4.0 base score is 8.3, indicating a high severity issue with network attack vector and no user interaction required.

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-88807 is a heap-based buffer overflow vulnerability in the libXrender library used by X.org. The flaw exists in the RenderQueryPictFormats function in libXrender versions before 0.9.13. A malicious X server could exploit this vulnerability to inject code into connected X clients. The vulnerability has a high severity score of 8.9 (CVSS 4.0) and requires user interaction with a high attack complexity. No known exploits are reported in the wild. A fix is implied to exist in version 0.9.13 and later.

CVE-2026-88806 is a heap-based buffer overflow vulnerability in libX11 versions before 1.8.14. It occurs during the handling of the XkbGetMap request, where the key_sym_map can be overflowed by a malicious X server. This vulnerability has a high severity with a CVSS score of 7.5. It requires user interaction and has a high impact on confidentiality, integrity, and availability.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

A heap-based buffer overflow vulnerability exists in the osmo-bsc component of Osmocom in versions from 1.0.1 up to but not including 1.14.1. The flaw is located in the ipaccess_proxy_read_msg() function and is triggered by malformed IPA frame lengths. This vulnerability can cause a denial of service by crashing the application but does not impact confidentiality or integrity.

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.