In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309305; Issue ID: MSV-10730.
In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309816; Issue ID: MSV-10731.
In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.
In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.
CVE-2026-78402 is a stack-based buffer overflow vulnerability in Thalesgroup Sentinel Keys Server on Windows. The vulnerability arises because the software does not properly validate the length of the first field in an input message. A local attacker can exploit this flaw by crafting a malicious input to trigger a buffer overflow, potentially leading to arbitrary code execution with NT AUTHORITY\SYSTEM privileges, enabling local privilege escalation. This affects versions prior to 1.3.8.0. The issue has been fixed in version 1.3.8.0.
CVE-2026-61627 is a high-severity out-of-bounds read and write vulnerability in libass, a subtitle renderer for ASS/SSA subtitle formats. Versions prior to 0.17.5 can overread and overwrite the glyph array during rendering of specially crafted subtitle content. This occurs in wrap modes other than two when a line ends with a literal backslash-n sequence and consists only of such sequences or spaces, causing loops to overshoot the glyph array by one. The vulnerability can lead to denial of service, with broader exploitation considered theoretical and constrained by memory protections. The issue is fixed in libass version 0.17.5.
libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream loaded through `ass_process_chunk`, enabled read-order checking, and later pruning of the malicious events. Read-order checking is enabled by default unless `ass_set_check_readorder` is called with zero; pruning must occur explicitly through `ass_prune_events` or through automatic pruning previously enabled with `ass_configure_prune`. On common systems with arithmetic right shift, 32-bit int values, the upper address region reserved to the kernel, and matching binary/kernel architecture, the expected consequence is denial of service. More extensive exploitation on uncommon systems is theoretical and strongly constrained by the target addresses, bit-clearing-only mutation, and ASLR. This issue is fixed in version 0.17.5.
CVE-2026-111487 is an out-of-bounds write vulnerability in the Qt Framework's assimp scene import plugin within the Qt3D module. It affects multiple Qt Framework versions starting from 6.5.0 up to but not including 6.8.10, 6.9.0 up to but not including 6.11.3, and 6.12.0 up to but not including 6.12.1. The vulnerability has a medium severity score of 4.3 and no known exploits in the wild. Fixed versions 6.8.10, 6.11.3, and 6.12.1 are available.
CVE-2026-65587 is an out-of-bounds write vulnerability in Imagination Technologies Graphics DDK. It occurs when a web page with unusual WebGPU content is loaded into the GPU GLES render process, causing the GPU user-space driver to write data beyond the intended memory boundary. This can lead to memory corruption and potentially crash the browser or GPU process.
CVE-2026-8822 is a high-severity memory corruption vulnerability in vtk version 9.6.1. It affects the vtkDEMReader ReadProfiles functionality, where processing a specially crafted USGS DEM file can cause a buffer overflow. This vulnerability allows an attacker to trigger a denial-of-service condition by crashing the application.
CVE-2026-8824 is a high-severity memory corruption vulnerability in vtk version 9.6.1. It affects the vtkBMPReader component's ExecuteDataWithInformation function, where processing a specially crafted BMP file can cause a buffer overflow. This vulnerability could lead to a denial of service by crashing the application.
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.
KeePassXC versions from 2.3.0 up to but not including 2.8.0 contain an out-of-bounds write vulnerability in the browser integration component. This occurs because a fixed 1 MiB output buffer is used for encrypting authorized responses, but the encryption function writes more data than this buffer can hold. The flaw can be triggered by a browser-protocol client with valid database association and access to the per-user IPC endpoint, causing a sequential out-of-bounds write before response delivery. The issue is fixed in version 2.8.0.
CVE-2026-111732 is a critical out-of-bounds write vulnerability in RT-Labs P-Net versions before 1.0.3 when built with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled. The vulnerability arises because the software parses a data length from a field not defined in the ARVendorBlock and uses it to copy bytes into a fixed-size buffer without proper bounds checking. This can be triggered by a crafted Connect request, potentially causing a crash or arbitrary code execution. The vulnerable option is disabled by default. A fix is available in version 1.0.3.
CVE-2026-111730 is an out-of-bounds write vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs because the LengthPeerStationName field in a CheckPeers block is not properly validated, allowing up to 15 bytes to be written beyond a 241-byte buffer. Exploitation requires establishing a session with adjacent network access. This can cause a crash or potentially allow arbitrary code execution. A fix is available in version 1.0.3.
CVE-2026-103392 is an out-of-bounds write vulnerability in the TCP header processing of Juniper Networks Session Smart Router. It allows an attacker to corrupt TCP payload data and potentially cause session desynchronization by sending a transit TCP packet with an oversized SACK option length. The issue affects multiple versions prior to fixed releases. The vulnerability has a medium severity rating with a CVSS score of 4.8.