CVE-2026-4149 is a critical remote code execution vulnerability in the Sonos Era 300 device. It arises from improper validation of the DataOffset field in SMB responses, leading to out-of-bounds memory access. This flaw allows unauthenticated remote attackers to execute arbitrary code with kernel privileges. The vulnerability affects Sonos Era 300 version 17.5 (build 91.0-70070). No official patch or remediation guidance has been provided yet.
Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the virtual memory permissions for linear memory used the wrong predicate to determine if resetting was necessary, where the compilation process used a different predicate. This divergence meant that the pooling allocator incorrectly deduced at runtime that resetting virtual memory permissions was not necessary while compile-time determine that virtual memory could be relied upon. The pooling allocator must be in use, Config::memory_guard_size configuration option must be 0, Config::memory_reservation configuration must be less than 4GiB, and pooling allocator must be configured with max_memory_size the same as the memory_reservation value in order to exploit this vulnerability. If all of these conditions are applicable then when a linear memory is reused the VM permissions of the previous iteration are not reset. This means that the compiled code, which is assuming out-of-bounds loads will segfault, will not actually segfault and can read the previous contents of linear memory if it was previously mapped. This represents a data leakage vulnerability between guest WebAssembly instances which breaks WebAssembly's semantics and additionally breaks the sandbox that Wasmtime provides. Wasmtime is not vulnerable to this issue with its default settings, nor with the default settings of the pooling allocator, but embeddings are still allowed to configure these values to cause this vulnerability. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.This issue affects rapidvms: before PR#96.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.This issue affects rapidvms: before PR#96.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.This issue affects rapidvms: before PR#96.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in joncampbell123 doslib.This issue affects doslib: before doslib-20250729.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C.
This issue affects gdal: before 3.11.0.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in yoyofr modizer (libs/libopenmpt/openmpt-trunk/include/premake/contrib/curl/lib modules). This vulnerability is associated with program files imap.C.
This issue affects modizer: before v4.3.
An improper restriction of operations within the bounds of a memory buffer vulnerability in Portwell Engineering Toolkits version 4.8.2 could allow a local authenticated attacker to read and write to arbitrary memory via the Portwell Engineering Toolkits driver. Successful exploitation of this vulnerability could result in escalation of privileges or cause a denial-of-service condition.
Improper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtual machine to potentially perform a denial of service attack against the host resulting in loss of availability.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.
CVE-2026-25585 is a high-severity vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.3. It involves improper bounds checking during ICC profile processing, specifically in IccCmm.cpp at line 5793, leading to an out-of-bounds read. This flaw can cause memory disclosure or segmentation faults by accessing memory beyond allocated arrays. Exploitation requires a user to open or process a malformed ICC profile, with no privileges needed but user interaction required. The vulnerability impacts confidentiality, integrity, and availability due to potential memory corruption and data leakage. No known exploits are currently reported in the wild, and the issue has been patched in version 2.
CVE-2026-25584 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.3. It occurs in the CIccTagFloatNum<>::GetValues() function when processing specially crafted ICC color profiles, allowing out-of-bounds writes on the stack. This can lead to memory corruption, potentially enabling information disclosure or arbitrary code execution. Exploitation requires local access and user interaction to process a malicious ICC file, but no privileges are needed. The vulnerability has been patched in version 2.3.1.
CVE-2026-25583 is a high-severity heap buffer overflow vulnerability in the iccDEV library, used for handling ICC color profiles. It occurs in the CIccFileIO::Read8() function when processing malformed ICC profile files due to an unchecked fread operation, leading to improper memory bounds restriction. The flaw affects versions prior to 2.3.1.3 and can be triggered by a local attacker with limited privileges and user interaction. Exploitation could result in complete compromise of confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild, but the vulnerability has been patched in version 2.3.1.
CVE-2026-25582 is a heap-based buffer overflow vulnerability in the iccDEV library used for ICC color profile manipulation. It occurs in the CIccIO::WriteUInt16Float() function when converting malformed XML to ICC profiles via the iccFromXml tool. The flaw affects versions prior to 2.3.1.3 and requires user interaction to trigger. Exploitation can lead to high impact on confidentiality, integrity, and availability, including potential remote code execution. The vulnerability has a CVSS score of 7.8 (high severity) and has been patched in version 2.3.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules). This vulnerability is associated with program files upnpreplyparse.C.
This issue affects DagorEngine: through dagor_2025_01_15.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardboardpowered/impl/world modules). This vulnerability is associated with program files WorldImpl.Java.
This issue affects cardboard: before 1.21.4.
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource (third_party/faad2-2.7/libfaad modules). This vulnerability is associated with program files bits.C, syntax.C.
This issue affects anyRTC-RTMP-OpenSource: before 1.0.