CVE-2026-76933 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It affects versions from 10-00 up to but not including 13-50-31. The flaw allows remote attackers to cause high confidentiality and integrity impact with low availability impact. A fix is available in version 13-50-31.
CVE-2026-86576 is a critical heap-based buffer overflow vulnerability affecting multiple Hitachi JP1 products, including JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components. The flaw exists in versions from 13-00 up to but not including 13-50-31 for Integrated Management and Automatic Job Management System 3 - Manager and Agent, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows remote attackers to execute arbitrary code or cause denial of service due to improper memory handling.
CVE-2026-86574 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Base affecting versions from 11-00 up to but not including 12-50-54. The flaw allows an attacker to execute arbitrary code or cause a denial of service due to memory corruption. The vulnerability has a CVSS 3.1 score of 9.8, indicating high severity with network attack vector and no required privileges or user interaction. The issue is fixed in version 12-50-54.
CVE-2026-116837 is a heap-based buffer overflow vulnerability in Ubiquiti Inc's airMAX M, LTU, SolarPoint, and SolarSwitch devices. An attacker with access to the adjacent network can exploit this flaw to execute arbitrary code on affected devices. The vulnerability affects multiple product versions prior to fixed releases. It has a high severity rating with a CVSS score of 8.8. Official fixes are available in versions 6.3.26, 2.4.2, 1.5.7, and 2.0.3.
CVE-2026-92208 is a heap-based buffer overflow vulnerability in NoMachine version 9.8.2_1. It arises from improper validation of the length of user-supplied data during the parsing of mDNS resource records. This flaw allows network-adjacent attackers to execute arbitrary code without authentication, running with the privileges of the service account.
CVE-2026-111183 is a critical heap-based buffer overflow vulnerability in the GStreamer rtpL16depay component. It arises from improper validation of the length of user-supplied RTP payload data before copying it to a heap buffer. This flaw allows remote attackers to execute arbitrary code within the context of the affected process without requiring user interaction or privileges.
CVE-2026-102484 is a heap-based buffer overflow vulnerability in the JJY refclock driver of NTPsec ntpd versions before 1.2.6. An attacker controlling the Telephone JJY time source can exploit this flaw by sending more than six time replies, potentially causing memory corruption or crashing the ntpd service. The issue is fixed in version 1.2.6.
CVE-2026-10136 is a critical heap-based buffer overflow vulnerability in the boa formUpload() functionality of the Totolink X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can send a specially crafted HTTP request to trigger this flaw, potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability.
A heap-based buffer overflow vulnerability exists in Pillow's JPEG decoder prior to version 13.0.0. The flaw occurs when decoding certain 8-bit lossless SOF3 JPEG images using libjpeg-turbo 3.x, which can ignore requested downscaling geometry, leading to buffer overflow. This can cause heap corruption, application crashes, or potentially allow code execution. The issue is fixed in Pillow version 13.0.0.
A heap-based buffer overflow vulnerability exists in the FlashPix JPEG-tile decoder of the Python Pillow library prior to version 13.0.0. This occurs when decoding crafted OLE2 FlashPix files, leading to writing beyond allocated buffer boundaries. The flaw can corrupt heap memory and potentially allow arbitrary code execution. The issue is fixed in Pillow version 13.0.0.
A heap-based buffer overflow vulnerability exists in the tiled-TIFF decoder of the Python Pillow library versions 8.2.0 through 12.x. This flaw allows reading beyond the allocated tile buffer when processing crafted tiled TIFF images, potentially exposing adjacent heap data or causing a crash. The issue is resolved in version 13.0.0.
CVE-2026-112393 is a critical heap-based buffer overflow vulnerability in the Pillow library when saving TIFF images to in-memory destinations like io.BytesIO. The flaw occurs in the _tiffWriteProc function, which incorrectly reallocates memory based on the current buffer size rather than the write position, allowing writes past the allocated heap buffer. This can cause memory corruption and potential data leakage of heap contents. The vulnerability affects Pillow versions from 2.0.0 up to but not including 13.0.0 and was introduced in 2013. It can be triggered by processing attacker-controlled TIFF images with large out-of-line tags or embedded ICC profiles. The issue does not affect saving TIFF images to real files. A fix is available in Pillow 13.0.0.
CVE-2026-10572 is a heap-based buffer overflow vulnerability in IBM MQ Operator that affects multiple versions up to 4.0.4 and some 9.4.x releases. An authenticated attacker could exploit this flaw by sending malformed MQPUT operations, potentially causing denial of service or arbitrary code execution. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available starting from version 3.4.0.
CVE-2026-10574 is a heap-based buffer overflow vulnerability in IBM MQ Operator that affects multiple versions up to 3.9.2 and some 4.x releases. An authenticated attacker can exploit this flaw by sending malformed message handle properties during MQPUT or MQPUT1 operations, potentially causing denial of service or arbitrary code execution. The vulnerability has a high severity with a CVSS score of 8.8. Fixed versions start from 3.4.0 onward.
CVE-2026-11831 is a heap-based buffer overflow vulnerability in IBM MQ Operator that allows an authenticated attacker to cause a limited denial of service and gain very limited information about process memory layout via an out-of-bounds read when processing a specially crafted client request. The vulnerability affects multiple versions of IBM MQ Operator prior to 3.4.0, where it has been fixed.
A heap-based buffer overflow vulnerability exists in the openGauss-server's HllObjectUnpack() function due to improper length validation when unpacking packed HyperLogLog (HLL) data. This flaw allows a specially crafted packed HLL input with inconsistent length fields to cause out-of-bounds writes, potentially leading to memory corruption. The issue affects multiple versions starting from 2.1.0 through various 3.x, 5.x, 6.x, and release candidate 7.0.0 versions. The vulnerability has been fixed in version 7.0.0-LTS by adding proper length checks and correcting buffer copy operations.
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
CVE-2026-108451 is a numeric truncation error vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 8.8 and affects specific versions prior to fixed releases. Official patches have been released by Microsoft to address this issue.
CVE-2026-108450 is a heap-based buffer overflow vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects specific versions prior to 16.0.14334.20974 and 16.0.17932.21056, which contain official fixes. The CVSS score of 8.8 indicates a high severity with potential for complete confidentiality, integrity, and availability impact. No known exploits are currently reported in the wild.
CVE-2026-108449 is a heap-based buffer overflow vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 8.8 and affects multiple versions prior to fixed releases. Official patches have been released by Microsoft to address this issue.