CWE-122: Heap-based Buffer Overflow vulnerabilities

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.

CVE-2026-69486 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 153.0.4234.32. Microsoft has released an official fix in version 153.0.4234.32 to address this issue. The vulnerability has a high severity rating with a CVSS score of 8.8.

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28173.

CVE-2026-91964 is a heap-based buffer overflow vulnerability in FreeRDP versions 2.0.0 and 3.0.0. It occurs in the nego_send_negotiation_request function when processing Server Redirection PDU messages containing attacker-controlled LoadBalanceInfo fields. An attacker controlling an RDP server can send an overly long field that overflows a fixed 512-byte buffer, potentially causing client crashes or enabling code execution if combined with memory disclosure.

CVE-2026-90439 is a heap-based buffer overflow vulnerability in the ngx_http_v3_module of NGINX Plus and NGINX Open Source when using HTTP/3 with OpenSSL versions up to 3.5.0 under certain configurations. This flaw can cause the NGINX worker process to restart or experience limited data corruption. The issue affects the data plane only and does not expose the control plane. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-54559 affects PocketSphinx, a small speech recognizer, due to improper boundary validation in language-model loaders and unbounded string usage in acoustic-model loaders. This can lead to stack or heap buffer overflows and memory corruption when loading invalid or malicious model files. The vulnerability is fixed in version 5.1.1. Users of versions prior to 5.1.1 should upgrade to mitigate this issue.

CVE-2026-19499 is a heap-based buffer overflow vulnerability in the GNU C Library (glibc) versions 2.38 through 2.44. It occurs when the functions strfmon or strfmon_l are called with right-justified width padding, potentially causing writes past the end of the output buffer. Exploitation requires a specific application code path where the destination buffer is large enough for padding but too small for an internal memmove operation. No network-facing impact is currently known.

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver (due to improper buffer size validation) leads to kernel memory corruption and a system crash.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.

CVE-2026-42807 is a heap-based buffer overflow vulnerability in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2. The flaw exists in the PC bridge protocol decoder, which fails to validate the packet length field from external devices before copying data into a fixed-size buffer. This can lead to heap corruption, causing denial of service or potential arbitrary code execution when processing malicious USB or BLE peripheral payloads.

CVE-2026-85103 is a critical heap-based buffer overflow vulnerability in the VPN certificate ASN.1 decoding component of Check Point Quantum Security Management and Quantum Security Gateway systems. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary code on affected systems. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No affected versions or patch information are provided, and no known exploits are reported in the wild.

CVE-2026-21104 is a heap-based buffer overflow vulnerability in the KnoxVault trustlet component of Samsung Mobile Devices. It affects versions prior to the SMR (Security Maintenance Release) September 2026 Release 1. The flaw allows local privileged attackers to execute arbitrary code on the affected device.

CVE-2026-21096 is a critical heap-based buffer overflow vulnerability in the JPEG decoder component (libimagecodec.quram.so) of Samsung Mobile Devices. This flaw exists in versions prior to the SMR Sep-2026 Release 1 and could allow remote attackers to execute arbitrary code on affected devices without user interaction or privileges.

CVE-2026-21095 is a critical heap-based buffer overflow vulnerability in the DNG decoder component of libimagecodec.quram.so on Samsung Mobile Devices. This flaw exists in versions prior to the SMR Sep-2026 Release 1 and could allow remote attackers to execute arbitrary code without user interaction or privileges.