Search: Value

OpenSlide versions through 4.0.1 contain a heap out-of-bounds read vulnerability in the MIRAX reader component. This flaw allows attackers to read beyond the bounds of the slide_positions array by crafting malicious Slidedat.ini values. Specifically, supplying a MIRAX slide with a CameraImageDivisionsPerSide value that does not evenly divide the image counts can cause application crashes and corrupt tile geometry.

catdoc versions through 0.95 have an out-of-bounds read vulnerability in the MULRK record handler within the process_item() function in src/xlsparse.c. This flaw allows attackers to craft malicious .xls workbooks or BIFF streams with a large end column value, causing the xls2csv utility to read beyond the intended buffer. Exploitation can lead to disclosure of adjacent process memory as CSV cells or cause the process to crash.

WildMIDI versions up to 0.5.0 contain a heap out-of-bounds read vulnerability in the HMP parser function _WM_ParseNewHmp(). This flaw allows attackers to craft .hmp files with underflowed chunk lengths that wrap to a large value, leading to reading beyond allocated buffers. Exploitation can cause application crashes or unintended exposure of heap memory through WildMidi_GetInfo().

CVE-2026-111159 is a heap out-of-bounds read vulnerability in libewf, a library used for handling EWF (Expert Witness Format) files. The flaw exists in the function libewf_lef_extended_attribute_read_data() where UTF-16 name and value sizes are validated incorrectly before being doubled. This allows attackers to craft malicious .L01/.Lx01 files with oversized extended attribute metadata counts, potentially causing application crashes or leaking uninitialized heap memory.

FreeImage (danoli3 fork) versions up to 3.19.23 contain a heap out-of-bounds read vulnerability in the Unpack32Bits() function within PluginPICT.cpp. This occurs because the rowBytes value, controlled by the input PICT file, is not validated against the PixMap width, allowing an attacker to cause an over-read of up to 64 KiB of heap memory. This can lead to memory disclosure or process crashes when processing crafted PICT files.

CVE-2026-111147 is a heap out-of-bounds read vulnerability in libyal's libesedb library, specifically in the function libesedb_record_get_multi_value(). This flaw allows attackers to read beyond allocated buffers by exploiting unbounded multi-value offset tables. A crafted ESE/EDB database processed by the esedbexport tool can trigger this vulnerability, potentially causing application crashes or disclosure of approximately 32 KiB of adjacent heap memory. The vulnerability affects version 0 of libesedb and has a CVSS 4.0 score of 6.9, indicating medium severity.

CVE-2026-111140 is a heap out-of-bounds read vulnerability in libyal's libregf library versions up to 0. It occurs in the function libregf_value_item_read_value_data() due to improper bounds checking of value data size without accounting for a 4-byte offset. Crafted REGF hive files of version 1.0 or 1.1 can trigger this flaw, potentially leaking adjacent heap memory or causing crashes in parsers such as regfexport and plaso.

libsmi versions up to 0.5.0 contain an out-of-bounds write vulnerability in the smiValueAsString() function. This flaw allows an attacker to overflow a fixed 1024-byte static buffer by supplying a crafted MIB with an OCTET STRING default value of 512 or more octets starting with a 0x00 byte. The overflow can corrupt adjacent library globals and cause crashes in smidump or other consumers.

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

CVE-2026-111222 is a high-severity vulnerability in Netgate pfSense CE up to version 2.9.0. It allows authenticated users with General Setup privileges to inject php.ini directives by submitting an unvalidated timezone value. This injection can lead to execution of PHP code as root after system boot or php-fpm restart.

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

Netgate pfSense CE up to version 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute arbitrary commands as root. The issue arises from improper validation of the CARP VHID value, which can include shell metacharacters. This vulnerability is triggered during interface IP alias configuration or when rendering CARP status, leading to command execution with elevated privileges.

A vulnerability in OpenPrinting CUPS prior to version 2.4.20 allows an attacker to influence the copy_banner() function in scheduler/ipp.c by controlling the IPP attributes-natural-language value. This can lead to directory traversal outside the intended banner directory and copying of arbitrary files into job-sheet spool objects, which may be delivered to attacker-observable endpoints. The issue is fixed in version 2.4.20.

Tianji, an open source analytics and monitoring platform, contains an SQL injection vulnerability in the getDateQuery() function prior to version 1.31.29. The vulnerability arises because the timezone value is interpolated directly into raw SQL without parameter binding, allowing authenticated workspace members, including read-only viewers, to execute arbitrary SQL commands. This can lead to unauthorized disclosure or modification of sensitive data such as credentials, API keys, and tenant information, or cause service disruption. The issue is resolved in version 1.31.29.

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.

CVE-2026-55453 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where the quote_string() function in backend/ipp.c improperly preserves carriage-return and line-feed characters in a remote printer-controlled marker-message. This allows an attacker to inject newline characters that the scheduler interprets as separate PPD control lines, enabling persistence of attacker-selected PPD keywords. A demonstrated exploit involves injecting a FoomaticRIPCommandLine value that executes in the filter context during a later print job on a Foomatic-backed queue. The issue is fixed in version 2.4.20.

A vulnerability in the golang-github-getkin-kin-openapi project versions from 0.136.0 up to but not including 0.143.0 allows a remote unauthenticated attacker to cause a nil-pointer panic. This occurs because the openapi3filter component improperly accepts OpenAPI 3.1 array schemas without the required items keyword and dereferences a nil Schema.Items value during request or response validation. The issue does not affect OpenAPI 3.0 documents and is fixed in version 0.143.0.

CVE-2026-100348 is a medium severity vulnerability in the kin-openapi library's openapi3 loader component. It involves a NULL pointer dereference in the resolveComponent function when processing additionalProperties in schema references. This occurs because the code dereferences c.Value.AdditionalProperties without checking if c.Value is nil, leading to a panic during loading of crafted OpenAPI documents. The issue affects kin-openapi versions prior to 0.145.0 and can cause denial of service by crashing applications that load untrusted OpenAPI specifications.

A path traversal vulnerability (CWE-22) exists in OPNsense core prior to version 26.1.11. The OpenVPN Client Specific Override common_name field improperly accepts path traversal sequences, allowing an authenticated user with Client Specific Override privileges to cause OpenVPN configuration files to be written outside the intended directory. This occurs because the value is concatenated into a file path without normalization or basename checks. Exploitation requires triggering a matching OpenVPN client-connect or authentication event. The vulnerability is fixed in version 26.1.11.