CWE-787: Out-of-bounds Write vulnerabilities

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.

CVE-2026-47235 is a heap-based buffer overflow vulnerability in SimulationCraft's simc tool affecting builds after release-820-01 and before a May 7, 2026 nightly build. The flaw arises from improper bounds checking on a JSON sockets array, leading to out-of-bounds writes that corrupt adjacent memory. This can cause crashes and potentially allow code execution. Attack vectors include malicious .simc profiles, compromised addon exports, or manipulated Battle.net API responses. A fix is included in the nightly build simc-1205-01-516b5d7, but no official release tag contains the patch yet.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an out-of-bounds write vulnerability (CWE-787). A low privileged attacker with remote access could exploit this flaw to cause a denial of service. The vulnerability has a high severity with a CVSS score of 7.6. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively.

CVE-2026-118435 is an out-of-bounds write vulnerability in the Samsung Open Source escargot project. This flaw allows buffer manipulation which can lead to integrity and availability impacts. The vulnerability has a medium severity with a CVSS score of 5.4. No affected versions or patch information are provided.

CVE-2026-57199 is a low-severity out-of-bounds write vulnerability in the Asterisk telephony toolkit. It affects the app_sms.c component, where externally controlled SMS lengths are copied into fixed-size buffers without proper bounds checking. This can lead to memory corruption or crashes if the SMS dialplan application is used without validating input data. The issue is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57191 is a high-severity classic stack-based buffer overflow vulnerability in Asterisk's res_pjsip_pubsub module. It occurs due to an unbounded sscanf call when parsing the MWI NOTIFY Message-Account field. An unauthenticated attacker can send a crafted packet to trigger this overflow, corrupting the transport and disabling all SIP functionality until the service is restarted. Fixed versions include Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57192 is a medium severity vulnerability in Asterisk's Codec2 decoder that allows an authenticated attacker to cause a heap buffer overflow via an out-of-bounds write triggered by a floor/ceil sample-count mismatch. The attacker must authenticate via SIP and establish a call using Codec2 to exploit this flaw. The issue affects multiple versions of Asterisk prior to fixed releases and requires the codec_codec2 module to be loaded and configured on the target endpoint. Fixed versions are available.

CVE-2026-57188 is a high-severity stack buffer overflow vulnerability in the res_xmpp module of Asterisk, an open source telephony toolkit. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. An authenticated attacker with an XMPP account on the same or federated server can exploit this by sending crafted packets to cause out-of-bounds writes. The vulnerability requires the res_xmpp module to be loaded and an XMPP connection configured. Fixed versions are available and should be applied.

CVE-2026-57189 is an out-of-bounds write vulnerability in Asterisk's chan_sip channel driver when the textsupport option is enabled. An authenticated attacker can trigger a T.140 RED out-of-bounds write during generation accumulation, potentially causing remote code execution or a crash. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Patches are available in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding certified releases.

CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It occurs in the ooTrace() trace-logging function due to an unbounded vsprintf write into a fixed 2048-byte buffer. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57194 is an out-of-bounds write vulnerability in the chan_unistim module of Asterisk, an open source telephony toolkit. This flaw allows an attacker to overflow the phone_number field by sending a crafted incoming request packet, potentially crashing the system. The vulnerability affects specific versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. Successful exploitation requires the chan_unistim module to be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or have an equivalent provisioning path. Fixed versions are available.

CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted audio file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. The issue is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVE-2026-93862 is an out-of-bounds read vulnerability in the FireCluster Sync processing of WatchGuard Fireware OS. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can exploit this flaw by sending specially crafted network traffic to repeatedly crash the cluster synchronization process. This results in a sustained denial of service condition. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high severity rating is assigned based on the CVSS 4.0 score of 7.2.

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

CVE-2026-103593 is a critical stack-based buffer overflow vulnerability in the WatchGuard Fireware OS logging service. It allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS 4.0 score of 9.1 reflects the potential for privilege escalation and remote code execution without user interaction.

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

CVE-2026-93857 is a critical stack-based buffer overflow vulnerability in WatchGuard Fireware OS's SIP proxy. It allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy using the SIP proxy. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS score of 9.2 reflects the potential for remote code execution without user interaction or privileges.

An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.

A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.