CWE-120: Buffer Overflow vulnerabilities

A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. Such manipulation of the argument ShareName/SelectName leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. This manipulation of the argument UserName/Password causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in Edimax EW-7478APC 1.04. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Request Handler. This manipulation of the argument selSSID causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing filename values in multipart upload data. A remote attacker may exploit this vulnerability by sending a crafted upload request with overly long input, causing memory corruption and resulting in a denial of service.

NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses `sscanf` with `%s` into 64-byte stack buffers when parsing LUT data lines. Input comes from `lineBuffer[4096]`, so a crafted .spi3d file can overflow by ~4000 bytes on non-Windows. Version 2.5.2 fixes the issue.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integration Service) allows Filter Failure through Buffer Overflow. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.3, from 6.1.2 before 6.1.*.

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

CVE-2026-3871 is a buffer overflow vulnerability in the UPnP DeletePortMapping() command of Zyxel VMG4005-B50B firmware versions up to and including 5.13(ABRL.5.4)C0. This vulnerability can be exploited by an adjacent attacker to cause a temporary denial-of-service (DoS) condition affecting the UPnP functionality of the device. The issue stems from improper size checking during buffer copy operations.

A buffer overflow vulnerability exists in the UPnP AddPortMapping() command of Zyxel VMG4005-B50B firmware versions up to and including 5.13(ABRL.5.4)C0. This vulnerability can be exploited by an adjacent attacker to cause a temporary denial-of-service (DoS) condition affecting the UPnP functionality of the device. The vulnerability is classified as CWE-120, indicating a classic buffer overflow due to lack of input size checking.

CVE-2026-25277 is a high-severity buffer overflow vulnerability in Qualcomm Snapdragon platforms related to memory corruption when using Strongbox. It affects multiple Snapdragon 8 series mobile platforms. The vulnerability allows an attacker with local privileges to cause a buffer overflow, potentially leading to complete confidentiality, integrity, and availability compromise. No official patch or remediation guidance is currently available.

CVE-2026-7454 is a high-severity buffer overflow vulnerability in Autodesk 3ds Max versions 2026 and 2027. It arises from improper handling of WRL files, where a maliciously crafted file can cause memory corruption. This vulnerability allows an attacker to execute arbitrary code within the context of the affected process, potentially leading to full compromise of the application. The vulnerability requires local access with user interaction to trigger. No official patch or remediation guidance has been confirmed yet.

CVE-2026-7452 is a high-severity buffer overflow vulnerability in Autodesk 3ds Max versions 2026 and 2027. It arises from improper handling of WRL files, allowing a maliciously crafted file to cause memory corruption. This can enable an attacker to execute arbitrary code within the context of the affected process. The vulnerability requires local access with user interaction to trigger. No official patch or remediation guidance has been confirmed at this time.

A buffer overflow vulnerability within AMD Sensor Fusion Hub Driver can allow a local attacker to write out of bounds, potentially resulting in denial of service or crash

Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, potentially resulting in a crash or denial of service

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-7287 is a high-severity buffer overflow vulnerability in Zyxel NWA1100-N firmware version 1.00(AACE.1)C0. It affects multiple functions within the device's 'webs' binary, allowing an attacker to cause a denial-of-service (DoS) by sending crafted HTTP requests. The vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing the device. No official patch or remediation guidance is currently available from Zyxel. There are no known exploits in the wild at this time.