Search: 18.8.3.2

A heap out-of-bounds read vulnerability exists in GNOME libgxps through version 0.3.2 in the function path_geometry_start_element(). This flaw allows attackers to craft XPS documents with malformed PolyBezierSegment or PolyQuadraticBezierSegment Points attributes, causing the application to read beyond allocated memory. This can lead to crashes in consumers like Evince and potentially expose adjacent heap memory contents.

libxmp versions through 4.7.4 have an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker component. This flaw allows attackers to supply a crafted headerless P61A module with specific characteristics to leak stack memory into sample metadata or disrupt module loading. The vulnerability has a medium severity rating with a CVSS score of 6.1.

OpenSlide versions through 4.0.1 contain a heap out-of-bounds read vulnerability in the MIRAX reader component. This flaw allows attackers to read beyond the bounds of the slide_positions array by crafting malicious Slidedat.ini values. Specifically, supplying a MIRAX slide with a CameraImageDivisionsPerSide value that does not evenly divide the image counts can cause application crashes and corrupt tile geometry.

Open Asset Import Library (assimp) versions through 6.0.5 have a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's animation keyframe handling. This flaw occurs when processing crafted .mesh files with morph animation tracks targeting missing submeshes or absent shared geometry, causing the host process to crash. The vulnerability has a medium severity rating with a CVSS score of 5.5.

Assimp versions through 6.0.5 have a NULL pointer dereference vulnerability in the Ogre3D importer. This flaw allows attackers to crash applications by supplying crafted .mesh and .skeleton files that reference a missing bone, causing a null pointer dereference in BoneById(). The vulnerability results in denial of service due to application crashes.

FluidSynth versions through 2.6.1 have an out-of-bounds write vulnerability triggered by specially crafted SoundFont files with modulator destination values between 63 and 255. This flaw allows attackers to corrupt heap and stack memory, potentially causing crashes when the malicious SF2 file is loaded and played.

AdPlug versions through 2.4 have a heap out-of-bounds read vulnerability in the CdmoLoader::load() function within src/dmo.cpp. This flaw allows attackers to read memory beyond a heap allocation by supplying a truncated TwinTeam DMO file. Specifically, a crafted 12- or 13-byte file can bypass dmo_unpacker::decrypt() and cause the application to read past the packed_module buffer, potentially crashing the application.

Node.js HTTP client library undici versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1 contain a vulnerability in the fetch() implementation. When a malicious server returns a response with more than five content codings and closes the connection before sending the body, the Node.js process crashes due to an unhandled error. This leads to a denial of service. The issue is fixed in versions 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to these or later versions. No workaround exists.

The AsyncHttpClient library versions from 2.0.0 until 2.16.1 and 3.0.12 have a vulnerability in the PropertiesBasedResumableProcessor component. It stores resumable download state in a predictable shared file path with default permissions, allowing local users to read sensitive download URLs or plant symbolic links to overwrite arbitrary files. This issue is fixed in versions 2.16.1 and 3.0.12.

A vulnerability in OpenPrinting CUPS prior to version 2.4.20 allows preservation of carriage-return and line-feed characters in a remote printer-controlled marker-message. This can lead to injection of newline characters that the scheduler interprets as separate PPD control lines, enabling an attacker to persist malicious PPD keywords. This may result in execution of attacker-controlled commands in the filter context during subsequent print jobs. The issue is fixed in version 2.4.20.

CVE-2026-55480 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where a race condition in the copy_model() function allows a privileged process to follow a symlink and overwrite arbitrary root-writable files. This occurs because a temporary file path is created in a group-writable directory without secure flags, enabling symlink attacks. Exploitation requires an attacker with lp-group write access and a privileged add-printer or modify-printer operation. The issue is fixed in version 2.4.20.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

FasterXML Jackson 1.x versions, including jackson-mapper-asl 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, contain a vulnerability that allows denial of service (DoS) attacks. This occurs when an attacker supplies deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-109413 is a high-severity vulnerability in the Symfony YAML component affecting versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The issue arises from uncontrolled recursion in the YAML parser's lexInlineStructure function, which does not properly limit nesting levels for inline collections. This can cause stack exhaustion and crash the process or cause a fatal error when parsing deeply nested YAML input. Any code parsing untrusted YAML is vulnerable, including endpoints using #[MapRequestPayload] without restricting the accepted format. The vulnerability is exploitable without authentication by sending a crafted YAML payload.

CVE-2026-108082 is a high-severity vulnerability in the Symfony PHP framework affecting multiple versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7. The issue arises from inefficient regular expression complexity in HeaderUtils::split(), which processes HTTP header values. This can cause exponential backtracking when parsing headers with runs of whitespace before separators, leading to high CPU usage and denial of service. The vulnerability is reachable without authentication via crafted HTTP requests. From 18 spaces onward, the regex engine hits backtrack limits, causing header directives to be silently dropped.

The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, and 5.0

The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, and 5.0