CVE-2026-32743 is a stack-based buffer overflow vulnerability in PX4-Autopilot versions 1.17.0-rc2 and earlier. The flaw exists in the MavlinkLogHandler component, where a fixed 60-byte buffer is overflowed due to unbounded sscanf parsing of file paths. An attacker with MAVLink link access can exploit this by creating deeply nested directories via MAVLink FTP and then requesting the log list, causing the flight controller's MAVLink task to crash. This results in denial of service by loss of telemetry and command capabilities. The vulnerability does not impact confidentiality or integrity but severely affects availability. No authentication or user interaction is required to trigger the issue. The vulnerability has a CVSS score of 6.5 (medium severity) and has been fixed in a recent commit.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the `BYTE_ARRAY_LEN` method, the `cram_byte_array_len_decode()` failed to validate that the amount of data being unpacked matched the size of the output buffer where it was to be stored. Depending on the data series being read, this could result either in a heap or a stack overflow with attacker-controlled bytes. Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. For the `VARINT` and `CONST` encodings, incomplete validation of the context in which the encodings were used could result in up to eight bytes being written beyond the end of a heap allocation, or up to eight bytes being written to the location of a one byte variable on the stack, possibly causing the values to adjacent variables to change unexpectedly. Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close. Because other CLI sessions remain unaffected, the impact is limited to a low‑severity availability disruption.
A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of the internal buffer, causing the CLI and web dashboard to become unavailable and leading to a denial of service.
A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fixed-size stack buffer within an internal process, resulting in a DoS attack.
A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an internal process, resulting in a DoS attack.
A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message to force an unbounded stack allocation and copy, causing a stack overflow and crash of the Zenoh bridge task. This vulnerability is fixed in 1.17.0-rc2.
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattu_can contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattu_can is enabled and running, a CAN-injection-capable attacker can trigger a crash (DoS) and memory corruption. This vulnerability is fixed in 1.17.0-rc2.
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized dev_name_len, causing a stack overflow in the driver and crashing the task (or enabling code execution). This vulnerability is fixed in 1.17.0-rc2.
Illustrator versions 29.8.4, 30.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-30980 is a medium severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccBasicStructFactory::CreateStruct() function, where uncontrolled recursion leads to stack exhaustion and a crash. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability impacts availability by causing application crashes but does not affect confidentiality or integrity. No known exploits are currently in the wild. The issue is fixed in version 2.3.
CVE-2026-31795 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXform3DLut::Apply() function, where input size is not properly checked before copying data, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction but does not require privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. Organizations using iccDEV for ICC color profile management should update to version 2.
CVE-2026-30987 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccTagNum<>::GetValues() function, where input size is not properly checked before copying data to a stack buffer, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction, but no privileges are needed. Successful exploitation could allow attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. The vulnerability affects software that processes ICC color profiles, which are widely used in imaging, printing, and color management applications. Organizations relying on iccDEV for color profile handling should upgrade to version 2.
CVE-2026-30983 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the icFixXml() function, which uses an unsafe strcpy call without verifying input size, leading to potential stack memory corruption or crashes. Exploitation requires local access and user interaction, but no privileges are needed. Successful exploitation could result in full confidentiality, integrity, and availability compromise of affected systems. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to applications relying on iccDEV for ICC color profile management. The vulnerability is fixed in version 2.3.
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK does not perform checks on input values potentially resulting in stack overflow. This could allow an attacker to perform code execution and denial of service.
EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code.