CWE-787: Out-of-bounds Write vulnerabilities

CVE-2026-17029 is a high-severity vulnerability in IBM i versions 7.3 through 7.6 that allows a local attacker to execute arbitrary code due to an out-of-bounds write condition. This vulnerability affects IBM i 7.3, 7.4, 7.5, and 7.6. The flaw could lead to complete compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-16975 is a high severity vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a heap-based buffer overflow that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

CVE-2026-16871 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a heap buffer overflow that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability and requires low attack complexity with no user interaction. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-16815 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a stack-based buffer overflow that could allow a remote attacker to cause a denial of service and potentially obtain sensitive information.

CVE-2026-16692 is a medium severity vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a stack-based buffer overflow that could be exploited by a remote authenticated attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but can disrupt availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.

CVE-2026-17223 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote authenticated attacker to execute arbitrary code due to a buffer overflow (CWE-787). The vulnerability has a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available.

CVE-2026-17206 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves an out-of-bounds write (buffer overflow) that could allow a remote attacker to execute arbitrary code. The vulnerability has a CVSS 3.1 score of 8.1, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

A heap out-of-bounds write vulnerability exists in rsync versions 3.2.5 through 3.4.4. This flaw allows remote unauthenticated attackers to write one byte beyond a heap allocation by supplying a specially crafted files-from entry containing both an interior and trailing backslash. The vulnerability occurs in the add_implied_include() function, which miscalculates buffer size due to under-counting the trailing backslash. This issue affects read-only rsync daemon modules.

CVE-2026-70458 is a high severity out-of-bounds write vulnerability in rsync versions 3.0.0 through 3.4.4. It occurs during processing of file entries with the FLAG_HLINKED flag when hard-link preservation is inactive, causing memory corruption due to missing F_SUM field in the file_struct layout. This flaw affects multiple Ubuntu LTS versions. No official patch or remediation guidance has been confirmed yet.

CVE-2026-70457 is a high-severity vulnerability in rsync versions 3.2.3 through 3.4.4. It involves an out-of-bounds write in the parse_size_arg() function due to incorrect handling of snprintf() return values. This can lead to memory corruption in the .bss segment.

An out-of-bounds write vulnerability exists in rsync versions 3.0.1 through 3.4.4 in the read_args() function. This flaw occurs when a crafted argument list causes the argv allocation to be exactly full, leading to a NULL terminator being written beyond the allocated boundary and corrupting adjacent heap memory. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-53792 is a high-severity vulnerability in rsync before version 3.5.0. It involves an out-of-bounds read on the sender side triggered by a malicious receiver sending a crafted checksum block with zero length. This causes a negative offset calculation during delta computation, leading to memory access before the start of an allocated buffer.

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux).

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-29331.