CWE-122: Heap-based Buffer Overflow vulnerabilities

CVE-2026-18282 is a heap-based buffer overflow vulnerability in the Sony XAV-9500ES device's AVRCP_Br_Response_Parser. It allows a network-adjacent attacker who can pair a malicious Bluetooth device with the target to execute arbitrary code. The flaw arises from improper validation of user-supplied data length before copying it to a heap buffer, leading to potential remote code execution.

CVE-2026-18281 is a heap-based buffer overflow vulnerability in the Sony XAV-9500ES device affecting version 3.02.00. It arises from improper validation of Bluetooth L2CAP packet lengths, allowing a network-adjacent attacker who can pair a malicious Bluetooth device to execute arbitrary code on the device. This vulnerability has a high severity rating with a CVSS score of 8. No public exploits or patches are currently documented.

CVE-2026-18271 is a heap-based buffer overflow vulnerability in the vCardParser component of Kenwood DNR1007XR devices, specifically version 1.7.0003.1000. This flaw allows an attacker with physical access to execute arbitrary code with root privileges without requiring authentication. The vulnerability arises from improper validation of user-supplied strings before copying them to a heap buffer.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.

CVE-2026-76889 is a heap-based buffer overflow vulnerability in the UMTS FP protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity rating with a CVSS score of 4.7.

A heap-based buffer overflow vulnerability exists in the RDP protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a CVSS score of 3.1, indicating a medium severity level. There is no indication of confidentiality or integrity impact, only availability is affected. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

A heap-based buffer overflow vulnerability exists in the Catapult DCT2000 file parser of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 4.7.

A heap-based buffer overflow vulnerability exists in the SSH protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5. No known exploits are reported in the wild. Patch status is not confirmed in the provided data.

A heap-based buffer overflow vulnerability exists in the Bluetooth AVRCP Profile protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition.

Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-76886 is a heap-based buffer overflow vulnerability in the C12.22 protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition.

A heap-based buffer overflow vulnerability exists in the RTSP service of TP-Link Systems Inc. Tapo C100/C101 version 5 devices. An authenticated attacker on the local network can send specially crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, resulting in a temporary denial-of-service condition.

CVE-2026-18102 is a heap-based buffer overflow vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It arises from an integer underflow during bounds checking, allowing a remote authenticated attacker to overwrite adjacent memory. The vulnerability has a low severity with a CVSS score of 3.5 and requires low privileges and high attack complexity. No known exploits are reported in the wild, and no official patch information is provided.

CVE-2026-63633 is a heap-based buffer overflow vulnerability in FreeRDP versions prior to 3.28.0. It occurs in the freerdp_dsp_decode_opus function when a malicious RDP server negotiates WAVE_FORMAT_OPUS with a client built with specific codec options. This can lead to heap corruption, client crashes, and potentially code execution. The issue is fixed in FreeRDP version 3.28.0.

CVE-2026-55194 is a heap-based buffer overflow vulnerability in FreeRDP versions prior to 3.27.0. The flaw exists in the rpc_client_recv_fragment function, which incorrectly uses the server-declared alloc_hint instead of the actual StubLength when ensuring buffer capacity. A malicious TS Gateway can exploit this by sending a specially crafted response that causes a buffer overflow, potentially leading to client crashes or remote code execution. The issue is fixed in FreeRDP version 3.27.0.

CVE-2026-55193 is a heap-based buffer overflow vulnerability in FreeRDP versions prior to 3.27.0. The flaw occurs because the client accepts a server-controlled max_xmit_frag value without proper bounds checking, allowing a malicious TS Gateway to send oversized fragments. This can cause a buffer overflow in the ReceiveFragment buffer, potentially crashing the client or enabling code execution. The issue is fixed in FreeRDP version 3.27.0.

CVE-2026-55191 is a heap-based buffer overflow vulnerability in FreeRDP versions prior to 3.27.0. It occurs when a malicious RDP server negotiates RDPGFX AVC444 with an H.264 decoder backend, causing an integer overflow during buffer size calculation. This leads to allocation of an undersized buffer and subsequent heap corruption, potentially allowing code execution. The issue is fixed in FreeRDP version 3.27.0.

A heap-based buffer overflow vulnerability exists in FFmpeg's VC-2/Dirac RTP packetizer component before commit 1cdeb3c. This flaw occurs because the packetizer copies a size value derived from input data into a fixed-size buffer without checking upper bounds, allowing crafted Dirac data units to cause memory corruption.

A heap-based buffer overflow vulnerability exists in FFmpeg's RIST protocol reader (libavformat/librist.c) before commit 1c10bcc. The function librist_read() improperly handles the size argument, copying the full payload length into a smaller destination buffer, which can be triggered remotely via the async:rist:// URL scheme by a malicious RIST sender. This vulnerability has a critical severity with a CVSS 4.0 score of 9.3.

CVE-2026-75141 is a heap-based buffer overflow vulnerability in FFmpeg's hvcC box writer. It occurs when writing an HEVC configuration record with more NAL units of a single type than the count field can represent, causing an overflow of the NAL unit count and subsequently a heap buffer overflow. This flaw can be triggered by a crafted HEVC input file during muxing.