virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.
CVE-2026-11381 is a heap-based buffer overflow vulnerability in IBM MQ for HPE NonStop. It affects versions from 8.1.0 up to and including 8.1.0.40. The flaw arises from improper validation of message distribution list structures, which could allow an authenticated attacker to cause denial of service or potentially execute arbitrary code. The vulnerability has a high severity with a CVSS score of 8.8.
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.
CVE-2026-10858 is a critical heap-based buffer overflow vulnerability in IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. It allows an authenticated attacker to cause denial of service or potentially execute arbitrary code by exploiting a heap buffer underflow when processing multi-segment messages.
IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap-based buffer overflow vulnerability caused by an integer overflow in MQINQ request validation. This flaw could allow an authenticated attacker to cause denial of service or potentially escalate privileges.
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded byte per value into that smaller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/tiff.imageio/tiffinput.cpp, TIFFInput::bit_convert(), TIFFInput::read_native_scanline_locked(), PHOTOMETRIC_SEPARATED, 1-bit CMYK, and native uint1 ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in 3.1.16.0.
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_native_tiles() copies each row into the caller buffer using the padded whole-tile scanline_stride rather than user_scanline_bytes for the requested rectangle, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/openexr.imageio/exrinput.cpp, OpenEXRInput::read_native_tiles(), partial edge tile, user_scanline_bytes, and scanline_stride, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
A heap-based buffer overflow vulnerability exists in HappySeaFox sail versions before 1.0.0. The flaw occurs in the PSD image loading code where a mismatch between pixel format and file depth causes out-of-bounds writes when loading crafted PSD files. This can lead to memory corruption, crashes, or potential code execution. The issue is fixed in version 1.0.0.
A heap-based buffer overflow vulnerability exists in HappySeaFox sail versions prior to 1.0.0. The flaw occurs when loading crafted color-mapped run-length-encoded TGA images, where the pixel buffer allocation does not match the attacker-controlled pixel size derived from the image header. This mismatch allows writing beyond the allocated heap buffer, potentially causing heap corruption, crashes, or code execution. The issue is an incomplete fix of a previous vulnerability (CVE-2026-40494) and has been resolved in version 1.0.0.
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.
Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.3 contain a heap-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to execute arbitrary code. The vulnerability is identified as CVE-2026-81477 and has a CVSS v3.1 score of 7.2, indicating high severity. No specific patch link is provided, but versions 11.1.0.3 and later are not affected.
Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.3 contain a heap-based buffer overflow vulnerability (CWE-122). This flaw allows a low privileged local attacker to potentially elevate privileges on the affected system. The vulnerability has a high severity with a CVSS score of 7.8. A fix is available in version 11.1.0.3.
CVE-2026-91106 is a critical heap-based buffer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP). It affects versions from 0 up to but not including 3.26.6. The vulnerability could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. HP has identified and remediated multiple vulnerabilities in HPLIP, including this one.
CVE-2026-91105 is a heap-based buffer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP) versions prior to 3.26.6. This flaw could allow remote attackers to cause remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. HP has identified and remediated this and other related vulnerabilities in HPLIP.
CVE-2026-91104 is a critical heap-based buffer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP). It affects versions from 0 up to but not including 3.26.6. The flaw could allow remote attackers to execute code, escalate privileges, cause denial of service, disclose information, or modify files without authorization under certain conditions. HP has identified and remediated this vulnerability.
A heap-based buffer overflow vulnerability (CWE-122) exists in HP Linux Imaging and Printing Software (HPLIP) versions prior to 3.26.6. This vulnerability could allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. The vulnerability has been identified and remediated by HP.
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.