CWE-122: Heap-based Buffer Overflow vulnerabilities

Adobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. Exploitation requires user interaction. The vulnerability has a high severity rating with a CVSS score of 7.8. No patch or official remediation has been confirmed at this time.

Adobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability (CVE-2026-48424) that can lead to arbitrary code execution with user interaction. The vulnerability requires a victim to open a malicious file to be exploited. It has a high severity rating with a CVSS score of 7.8. No patch or official remediation has been confirmed yet.

Adobe Substance 3D Designer contains a heap-based buffer overflow vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. Exploitation requires user interaction. The vulnerability has a high severity rating with a CVSS score of 7.8.

Adobe Substance 3D Designer contains a heap-based buffer overflow vulnerability that can lead to arbitrary code execution when a user opens a specially crafted malicious file. This vulnerability requires user interaction and affects the context of the current user. No patch or official remediation has been confirmed yet.

Adobe Substance 3D Designer contains a heap-based buffer overflow vulnerability that may allow arbitrary code execution when a user opens a malicious file. Exploitation requires user interaction. The vulnerability has a high severity rating with a CVSS score of 7.8.

Adobe Substance 3D Designer contains a heap-based buffer overflow vulnerability that may allow arbitrary code execution when a user opens a specially crafted malicious file. Exploitation requires user interaction. The vulnerability has a high severity score of 7.8 but no patch or official remediation has been confirmed yet.

Adobe Substance 3D Designer contains a heap-based buffer overflow vulnerability that can lead to arbitrary code execution when a user opens a malicious file. This vulnerability requires user interaction and affects the context of the current user. The CVSS score is 7.8, indicating a high severity level. No patch or official remediation has been confirmed yet.

OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap-based buffer overflow vulnerability triggered when exrmetrics processes crafted deep scanline EXR files with specific pixel conversion options. This vulnerability is fixed in versions 3.3.13 and 3.4.14.

A heap-based buffer overflow vulnerability exists in AcademySoftwareFoundation's openexr library in certain versions when processing crafted tiled EXR files on 32-bit/ILP32 builds. The issue arises due to an integer overflow in buffer size calculation, leading to out-of-bounds writes during tile decoding. This vulnerability is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVE-2026-19874 is a critical heap-based buffer overflow vulnerability in Konami's Metal Gear Online 3 version 1.1.2.8. The flaw arises from improper validation of the "kick_num" lobby data field, which controls the number of kicked player IDs processed. The game limits matches to 16 players, but the vulnerable function does not enforce this limit, allowing writes beyond the allocated buffer. This overflow can overwrite adjacent memory containing Steam callback handler structures, including function pointers. Exploitation could lead to control-flow hijacking and potentially arbitrary code execution within the game process.

CVE-2026-50538 is a heap-based buffer overflow vulnerability in LibVNCClient versions 0.9.12 through 0.9.15. A malicious or man-in-the-middle VNC server can exploit this flaw by sending a crafted FramebufferUpdate message that causes libvncclient to write attacker-controlled data beyond the framebuffer boundary. This vulnerability requires no authentication and triggers immediately upon connection, causing unconditional client crashes (denial of service) and potentially allowing remote code execution by overwriting application callback pointers. The issue is patched in a commit identified as 540332be3e0acc566fa64da6f1b4680c72c724dd.

A heap-based buffer overflow vulnerability exists in capstone-engine versions prior to 6.0.0-Alpha10 in the SH floating-point decoders. The issue arises when crafted instructions cause the operand count to exceed the allocated buffer size, leading to a four-byte overflow. This can crash the process and potentially allow code execution depending on heap layout. The vulnerability is fixed in version 6.0.0-Alpha10.

CVE-2026-70654 is a heap-based buffer overflow vulnerability in libvips, a fast image processing library. The flaw exists in versions prior to 8.18.3 when processing untrusted uncompressed PPM images using unusual custom libvips sources. The issue arises from an incorrect use of VIPS_MAX instead of VIPS_MIN in the function vips_source_read_to_memory, allowing up to 4032 bytes to be written beyond the allocated heap buffer. This can lead to memory corruption or a process crash. The vulnerability is fixed in libvips version 8.18.3.

A heap-based buffer overflow vulnerability exists in libvips versions prior to 8.18.3 in the old-style Radiance RLE decoder. This flaw allows processing of a repeat marker at the start of a scanline that leads to reading memory before the start of pixel data. Exploiting this can disclose four bytes of adjacent heap memory, potentially leaking other image data. The issue is fixed in libvips version 8.18.3.

A heap-based buffer overflow vulnerability exists in libvips prior to version 8.18.3. The flaw arises from improper scanline validation when processing crafted many-band TIFF images, leading to an integer overflow and unsafe buffer-region calculations. This can cause out-of-bounds reads or writes, potential data disclosure, and likely process crashes. Remote code execution has not been demonstrated but cannot be excluded. The issue is fixed in libvips version 8.18.3.

CVE-2026-18307 is a heap-based buffer overflow vulnerability in GIMP version 3.2.2 related to the parsing of TIF files. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious TIF file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data length before copying it to a heap buffer.

A heap-based buffer overflow vulnerability exists in GIMP 3.2.2 during the parsing of TIF files. This flaw allows remote attackers to execute arbitrary code if a user opens a crafted malicious TIF file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data length before copying it to a heap buffer.

CVE-2026-18298 is a heap-based buffer overflow vulnerability in GStreamer's PNG file parsing component. It allows remote attackers to execute arbitrary code by exploiting improper validation of user-supplied data length before copying it to a heap buffer. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity score of 7.8 CVSS v3.0.

CVE-2026-18296 is a heap-based buffer overflow vulnerability in GStreamer's MRF file parsing functionality. It allows remote attackers to execute arbitrary code by supplying malicious MRF files. Exploitation requires user interaction, such as opening a crafted file or visiting a malicious page. The flaw arises from improper validation of user-supplied data length before copying to a heap buffer.