The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer by 65,519 bytes. The IRET frame push can therefore write past the end of the buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.
CVE-2026-25259 is a high-severity vulnerability in Qualcomm Snapdragon products involving an out-of-bounds write due to memory corruption when processing multiple IOCTL commands for escape operations. The flaw affects various Snapdragon components and chipsets. It has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available. There are no known exploits in the wild at this time.
CVE-2025-59614 is a medium severity vulnerability in Qualcomm Snapdragon products involving an out-of-bounds write due to memory corruption when sending a random number generator command with an insufficient output buffer size. This flaw affects multiple Snapdragon components and chipsets. The vulnerability can impact confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. No known exploits are reported in the wild.
CVE-2025-59611 is a medium severity vulnerability in Qualcomm Snapdragon products involving an out-of-bounds write due to lack of input validation in diagnostic services. This memory corruption issue affects a broad range of Snapdragon platforms and related components. The vulnerability has a CVSS score of 6.7, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.
CVE-2025-59605 is a high severity vulnerability in Qualcomm Snapdragon products involving an out-of-bounds write due to processing device identifier strings that exceed expected lengths. This memory corruption issue affects a wide range of Snapdragon platforms and related components. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.
In wlan STA driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00480851; Issue ID: MSV-6338.
CVE-2026-20455 is a high-severity vulnerability in MediaTek chipsets caused by an out-of-bounds write due to a missing bounds check in the geniezone component. Exploitation does not require user interaction but requires the attacker to already have System privilege. Successful exploitation could lead to local escalation of privilege with high impact on confidentiality, integrity, and availability. The vulnerability affects a wide range of MediaTek chipset models. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.
CVE-2026-20453 is an out-of-bounds write vulnerability in the MediaTek chipset's geniezone component caused by a missing bounds check. This flaw could allow a local attacker who already has System privileges to escalate their privileges further without requiring user interaction. The vulnerability affects multiple MediaTek chipset versions. The CVSS score is 6.7, indicating a medium severity level. No official patch or remediation guidance has been confirmed yet.
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)
* httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)
* httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)
* httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)
* Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.
CVE-2026-24201 is a medium severity vulnerability in the NVIDIA Virtual GPU Manager involving an out-of-bounds write. This flaw could allow an attacker with local access and low privileges to cause data tampering, denial of service, or information disclosure. The vulnerability affects all versions up to and including the March 2026 release (version 595.58.02). No official patch or remediation guidance is currently available from NVIDIA, and no known exploits are reported in the wild.
CVE-2026-24193 is a high-severity vulnerability in NVIDIA GeForce display drivers for Windows and Linux that allows an out-of-bounds write. Exploitation could lead to denial of service, privilege escalation, information disclosure, data tampering, or code execution. The issue affects all driver versions prior to 580.159.03. No official patch or remediation guidance is currently confirmed from the vendor. The vulnerability requires local access with low privileges and no user interaction is needed for exploitation.
CVE-2026-7451 is an out-of-bounds write vulnerability in Autodesk 3ds Max versions 2026 and 2027 triggered by parsing a maliciously crafted TIF file. Exploitation can lead to application crashes, data corruption, or arbitrary code execution within the context of the affected process. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided by Autodesk as of the publication date. There are no known exploits in the wild at this time.
NVIDIA TensorRT has a high-severity vulnerability (CVE-2026-24188) involving an out-of-bounds write (CWE-787). Exploiting this flaw could allow an attacker to tamper with data. The vulnerability does not require user interaction or privileges and can be exploited remotely. There is no official patch or remediation level currently provided by NVIDIA. No known exploits are reported in the wild at this time.
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.