HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any `.gzi` index files from untrusted sources, and use the `bgzip -r` option to recreate them.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the `BYTE_ARRAY_STOP` method, an out-by-one error in the `cram_byte_array_stop_decode_char()` function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. For the `VARINT` and `CONST` encodings, incomplete validation of the context in which the encodings were used could result in up to eight bytes being written beyond the end of a heap allocation, or up to eight bytes being written to the location of a one byte variable on the stack, possibly causing the values to adjacent variables to change unexpectedly. Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the `cram_decode_seq()` did not handle this correctly in some cases. Where this happened it could result in reading a single byte from beyond the end of a heap allocation, followed by writing a single attacker-controlled byte to the same location. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
CVE-2025-64301 is a high-severity out-of-bounds write vulnerability in the EMF functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers an out-of-bounds write, potentially leading to arbitrary code execution. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. This flaw impacts confidentiality, integrity, and availability, making it critical for affected users to apply mitigations promptly. No known exploits are currently in the wild, but the risk remains significant due to the potential for remote code execution. Organizations using Canva Affinity in creative and design workflows should prioritize patching once available and implement strict file handling policies. Countries with significant usage of Canva Affinity and high-value creative industries are at greater risk.
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsf_rc is enabled on a CRSF serial port, an adjacent/raw-serial attacker can trigger memory corruption and crash PX4. This vulnerability is fixed in 1.17.0-rc2.
CVE-2026-0957 is a high-severity memory corruption vulnerability in Digilent DASYLab caused by an out-of-bounds write when loading a corrupted file. Exploitation requires user interaction to open a maliciously crafted file. Successful exploitation can lead to information disclosure or arbitrary code execution. This affects all versions of DASYLab. No patch or official remediation guidance is currently provided by the vendor.
CVE-2026-0954 is a high-severity memory corruption vulnerability in Digilent DASYLab caused by an out-of-bounds write when loading a corrupted . DSB file. Exploitation requires user interaction to open a specially crafted file, potentially leading to information disclosure or arbitrary code execution. This affects all versions of DASYLab. No patch or official remediation has been indicated yet.
CVE-2026-27703 is a high-severity out-of-bounds write vulnerability in RIOT-OS, an open-source operating system for IoT and embedded devices. The flaw exists in the default handler for the coap_well_known_core resource, which writes user-supplied option data into a fixed-size buffer without proper size validation. This can lead to corruption of adjacent stack memory, including critical control flow data such as return addresses. Exploitation can result in denial of service or arbitrary code execution without requiring authentication or user interaction. The vulnerability affects RIOT versions up to and including 2026.01. Although no known exploits are currently reported in the wild, the ease of remote exploitation and potential impact on device integrity make this a significant threat. Organizations deploying RIOT-OS in IoT environments should prioritize patching and implement strict input validation and memory safety practices to mitigate risk.
Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-31797 is a medium severity vulnerability in iccDEV, a library suite for ICC color profile management. Versions prior to 2.3.1.5 contain a heap out-of-bounds read in the CTiffImg::ReadLine() function when processing crafted TIFF images via iccApplyProfiles. This flaw can lead to memory disclosure or application crashes. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability affects confidentiality and availability but not integrity. No known exploits are currently reported in the wild. The issue is fixed in version 2.
CVE-2026-31796 is a high-severity heap-based buffer overflow vulnerability in the icCurvesFromXml() function of the iccDEV library, used for ICC color profile management. Versions prior to 2.3.1.5 are affected, allowing an attacker with local access and user interaction to trigger heap memory corruption, potentially leading to application crashes or arbitrary code execution. The vulnerability requires the victim to process a crafted ICC profile XML data, and no privileges are needed to exploit it. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. The issue is fixed in version 2.3.1.
CVE-2026-31795 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXform3DLut::Apply() function, where input size is not properly checked before copying data, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction but does not require privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. Organizations using iccDEV for ICC color profile management should update to version 2.