The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.
That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.
A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.
The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.
A vulnerability in the python-pillow Pillow library allows a crafted PPM or PGM image file to declare a width of 0, which is accepted and leads to an out-of-bounds write in the native morphology operation code. This causes a crash and potential memory corruption when running morphology operations on such images.
A heap-based buffer overflow vulnerability exists in the FlashPix JPEG-tile decoder of the Python Pillow library prior to version 13.0.0. This occurs when decoding crafted OLE2 FlashPix files, leading to writing beyond allocated buffer boundaries. The flaw can corrupt heap memory and potentially allow arbitrary code execution. The issue is fixed in Pillow version 13.0.0.
CVE-2026-110680 is a high-severity out-of-bounds write vulnerability in Cpanel::JSON::XS versions from 4.20 up to but not including 4.80. The flaw occurs during canonical encoding of tied or shared hashes in Perl, where the encoder mismanages array sizing for keys, leading to memory corruption and potential process crashes.
CVE-2026-109588 is a numeric truncation error vulnerability in FreeRTOS-Kernel versions 11.3.0 and 11.3.1 on the Arm Cortex-R82 MPU port. This flaw allows an unprivileged task on MPU-enabled builds to potentially read or write privileged kernel memory beyond the intended buffer boundaries via a stream buffer system call. The vulnerability is fixed in version 11.3.2 and later.
CVE-2026-102692 is a critical integer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.07. It arises from the nanocoap module accepting oversized CoAP Block2 option values without enforcing the 20-bit maximum block number limit. This allows block offset multiplication to overflow on 32-bit targets, leading to invalid slice ranges. A remote CoAP client can exploit this by sending a malformed Block2 option, potentially causing out-of-bounds memory access, denial of service, or memory corruption. The vulnerability is fixed in version 2026.07.
CVE-2026-85746 is a critical out-of-bounds write vulnerability in the MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs in the ST_AsText function when converting deeply nested GeometryCollections, where recursive WKT serialization fails to properly account for buffer size, leading to memory corruption. A low-privileged remote attacker can exploit this to potentially achieve code execution when combined with another vulnerability. The issue is fixed in the specified later versions.
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.
CVE-2026-79841 is a medium severity buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop RDMA SERVICES NSK. It involves an out-of-bounds memory write that can lead to memory corruption. The vulnerability requires local access with high privileges and user interaction to exploit. No affected versions or patch information are currently provided.
CVE-2026-103415 is a critical out-of-bounds write vulnerability in the Eclipse Foundation's NetX Duo TLS 1.3 client implementation. When processing a HelloRetryRequest, the client copies the server's cookie into the second ClientHello message without verifying that the cookie fits within the allocated packet buffer. This flaw allows a malicious or compromised server to overwrite memory beyond the intended buffer before certificate authentication completes. Only the client-side TLS path is affected.
CVE-2026-103414 is a high-severity out-of-bounds write vulnerability in the Eclipse Foundation's GUIX binary resource (theme) loader. The vulnerability arises because the loader uses two separate passes with independent cursor arithmetic to size and populate its memory arena, but does not validate the size field `gx_page_header_data_size` against the actual glyph data. This leads to a mismatch in glyph counts and causes the loader to write beyond the allocated buffer, using content directly from the resource file. The vulnerable buffer is internally allocated by GUIX, and the public API does not allow caller control over the size, making it impossible for callers to prevent this overflow. This issue affects versions from 0 up to and including 6.5.1.202602a and is present in the default configuration where `GX_BINARY_RESOURCE_SUPPORT` is enabled.
CVE-2026-101976 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an eBGP peer that has not negotiated four-octet-AS capability to send a specially crafted BGP update, causing a denial-of-service (DoS) condition. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patched releases. The CVSS v3.1 score is 7.5, indicating high severity due to the potential for service disruption without requiring privileges or user interaction.
CVE-2026-92158 is an integer overflow vulnerability in the NASA F´ (F Prime) framework used for spaceflight and embedded software. Versions prior to 4.2.0 perform a stack write validation that can overflow a 32-bit unsigned integer when adding an attacker-controlled offset and size, leading to out-of-bounds memory writes. This can cause memory corruption resulting in denial of service or potential code execution. The vulnerability is fixed in version 4.2.0.
CVE-2026-102179 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It affects systems with a configured BGP EVPN peer and the l2vpn-evpn RIB telemetry sensor subscribed. Exploitation can cause the rpd daemon to crash, resulting in denial of service and interruption of routing protocols until recovery.
CVE-2026-102177 is an out-of-bounds write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 7.6, indicating high severity.