zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the advanced forwarding toolkit (evo-aftmand/evo-pfemand) of Juniper Networks Junos OS Evolved on PTX Series or QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).An attacker sending crafted multicast packets will cause line cards running evo-aftmand/evo-pfemand to crash and restart or non-line card devices to crash and restart. Continued receipt and processing of these packets will sustain the Denial of Service (DoS) condition.
This issue affects Junos OS Evolved PTX Series:
* All versions before 22.4R3-S8-EVO,
* from 23.2 before 23.2R2-S5-EVO,
* from 23.4 before 23.4R2-EVO,
* from 24.2 before 24.2R2-EVO,
* from 24.4 before 24.4R2-EVO.
This issue affects Junos OS Evolved on QFX5000 Series:
* 22.2-EVO version before 22.2R3-S7-EVO,
* 22.4-EVO version before 22.4R3-S7-EVO,
* 23.2-EVO versions before 23.2R2-S4-EVO,
* 23.4-EVO versions before 23.4R2-S5-EVO,
* 24.2-EVO versions before 24.2R2-S1-EVO,
* 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO.
This issue does not affect Junos OS Evolved on QFX5000 Series versions before: 21.2R2-S1-EVO, 21.2R3-EVO, 21.3R2-EVO, 21.4R1-EVO, and 22.1R1-EVO.
A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.
CVE-2026-4177 is a critical heap-based buffer overflow vulnerability in YAML::Syck versions through 1.36 for Perl. The flaw occurs when class names exceed the initial 512-byte allocation in the YAML emitter. Additional issues include a base64 decoder reading past buffer ends on trailing newlines, corruption of shared node data due to strtok mutating type IDs, and a memory leak when adding anchors to nodes that already have one. Red Hat has issued security advisories and updates addressing these vulnerabilities.
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf_rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsf_rc is enabled on a CRSF serial port, an adjacent/raw-serial attacker can trigger memory corruption and crash PX4. This vulnerability is fixed in 1.17.0-rc2.
In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-31795 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXform3DLut::Apply() function, where input size is not properly checked before copying data, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction but does not require privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. Organizations using iccDEV for ICC color profile management should update to version 2.
CVE-2026-30987 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccTagNum<>::GetValues() function, where input size is not properly checked before copying data to a stack buffer, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction, but no privileges are needed. Successful exploitation could allow attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. The vulnerability affects software that processes ICC color profiles, which are widely used in imaging, printing, and color management applications. Organizations relying on iccDEV for color profile handling should upgrade to version 2.
CVE-2026-30985 is a high-severity heap-based buffer overflow vulnerability in the iccDEV library, specifically in the CIccMatrixMath::SetRange() function prior to version 2.3.1.5. This vulnerability arises from improper bounds checking during buffer copy operations, leading to potential memory corruption, application crashes, or exploitation. The flaw requires local access and user interaction but no privileges, making exploitation moderately challenging. Successful exploitation could allow attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. Organizations using iccDEV versions before 2.3.
CVE-2026-30983 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the icFixXml() function, which uses an unsafe strcpy call without verifying input size, leading to potential stack memory corruption or crashes. Exploitation requires local access and user interaction, but no privileges are needed. Successful exploitation could result in full confidentiality, integrity, and availability compromise of affected systems. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to applications relying on iccDEV for ICC color profile management. The vulnerability is fixed in version 2.3.
CVE-2026-30981 is a medium severity heap-buffer-overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXmlArrayType<>::DumpArray() function, which performs a buffer copy without proper bounds checking, leading to out-of-bounds reads and potential application crashes. Exploitation requires local access and user interaction, as indicated by the CVSS vector, and does not require privileges. While no known exploits are currently in the wild, successful exploitation could cause denial of service due to crashes. The vulnerability impacts confidentiality minimally but has a high impact on availability. Organizations using iccDEV for ICC color profile management should upgrade to version 2.3.
CVE-2026-30979 is a high-severity heap-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccCalculatorFunc::InitSelectOp() function and can be triggered by local user interaction, leading to memory corruption, crashes, and potentially arbitrary code execution. Exploitation requires local access and user interaction but does not require prior privileges. The vulnerability impacts confidentiality, integrity, and availability due to the possibility of executing malicious code or causing denial of service. No known exploits are currently reported in the wild. The issue is fixed in version 2.3.
In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00473802; Issue ID: MSV-5970.
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
This update for munge fixes the following issues:
- CVE-2026-25506: buffer overflow in message unpacking (bsc#1257651).
- Make `logrotate` work on log as user `munge` to prevent local privilege escalation (bsc#1246088).