CVE-2026-25502 is a high-severity stack-based buffer overflow vulnerability in the icFixXml() function of the iccDEV library, used for handling ICC color profiles. It affects versions prior to 2.3.1.2 and can be triggered by processing specially crafted NamedColor2 tags in malformed ICC profiles. Exploitation requires local access and user interaction but can lead to arbitrary code execution, compromising confidentiality, integrity, and availability. No known exploits are currently in the wild. European organizations using iccDEV in image processing or color management workflows should prioritize updating to version 2.3.1.
An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with elevated privileges.
Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.
Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is too large, this can result in a stack overflow. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not use rules with datasets `save` nor `state` options.
xrdp is an open source RDP server.xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition.
This recursion occurs in _ux_host_class_storage_partition_read(), which parses up to four partition entries. If an extended partition is found (with type UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED or EXTENDED_LBA_MAPPED), the code invokes:
_ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(...));
There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.
CVE-2026-1361 is a high-severity stack-based buffer overflow vulnerability in Delta Electronics' ASDA-Soft software. It allows a local attacker with limited privileges to execute arbitrary code or cause denial of service by triggering a buffer overflow. Exploitation requires user interaction but no prior authentication. The vulnerability affects confidentiality, integrity, and availability, with a CVSS score of 7.8. No patches have been released yet, and no known exploits are in the wild. European organizations using ASDA-Soft in industrial automation and manufacturing sectors are particularly at risk. Mitigation currently involves restricting local access and monitoring for suspicious activity until a vendor patch is available.
CVE-2026-0792 is a high-severity stack-based buffer overflow vulnerability in the ALGO 8180 IP Audio Alerter device. It arises from improper validation of the Alert-Info header in SIP INVITE requests, allowing remote attackers to execute arbitrary code without authentication or user interaction. The vulnerability affects version 5.5 of the product and can compromise confidentiality, integrity, and availability of the device. Although no known exploits are currently in the wild, successful exploitation could lead to full device takeover. European organizations using these devices in critical communication infrastructures are at risk. Mitigation requires immediate patching once available, network segmentation, and filtering of SIP traffic to prevent malicious INVITE requests. Countries with significant deployments of ALGO IP Audio Alerters and critical public safety or enterprise communication systems are most likely affected. The vulnerability’s CVSS score of 8.1 reflects its high impact and remote exploitability without authentication.
CVE-2026-0791 is a high-severity stack-based buffer overflow vulnerability in the ALGO 8180 IP Audio Alerter device, specifically in the handling of the SIP INVITE Replaces header. This flaw allows remote attackers to execute arbitrary code without authentication by sending a specially crafted SIP INVITE request. The vulnerability arises from improper validation of user-supplied data length before copying it into a fixed-size stack buffer, leading to potential remote code execution. The CVSS score is 8.1, indicating a significant risk to confidentiality, integrity, and availability. No known exploits are currently in the wild, and no patches have been published yet. European organizations using this device in critical communication infrastructure may face risks of device takeover or disruption. Mitigation should focus on network-level protections, strict SIP traffic filtering, and close monitoring until a vendor patch is available. Countries with higher adoption of ALGO devices and strategic reliance on IP audio alerting systems are at greater risk.
CVE-2026-21903 is a stack-based buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS. It allows a network-based attacker with low privileges and no user interaction to cause a denial-of-service (DoS) by crashing and restarting the Flexible PIC Concentrator (FPC) through subscribing to telemetry sensors at scale. The vulnerability affects multiple versions of Junos OS prior to 22.4R3-S7, 23.2 before 23.2R2-S4, and 23.4 before 23.4R2. The issue does not occur if YANG packages for the specific sensors are installed. The CVSS 3.
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption.
Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.
Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.
In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5534.
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689259 / MOLY01586470; Issue ID: MSV-4847.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
QTS 5.2.8.3332 build 20251128 and later
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
License Center 2.0.36 and later
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
QTS 5.2.8.3332 build 20251128 and later