CWE-120: Buffer Overflow vulnerabilities

Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28129.

IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.

CVE-2025-48723 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central software, specifically affecting version 5.0.x.x. A remote attacker who has obtained a user account with limited privileges can exploit this flaw to modify memory or cause process crashes, potentially leading to denial of service or further exploitation. The vulnerability does not require user interaction but does require authentication with a user-level account. The issue has been fixed in Qsync Central version 5.0.0.

CVE-2025-48724 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes without requiring user interaction. The vulnerability is classified under CWE-120, indicating a classic buffer overflow issue. The vendor has released a fix in Qsync Central version 5.0.0.

CVE-2025-48725 is a buffer overflow vulnerability in QNAP Systems Inc. 's QuTS hero operating system versions h5.3.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially causing denial of service or instability. The vulnerability requires low privileges (a user account) but no user interaction. It has a low CVSS 4.0 score of 0.6 due to limited impact and exploitation complexity. The issue is fixed in QuTS hero version h5.

CVE-2025-52868 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially disrupting service or causing instability. The vulnerability does not require user interaction but does require low-level privileges (a user account). It has a low CVSS 4.0 score of 0.6, reflecting limited impact and exploitation complexity.

CVE-2025-52869 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central software, specifically affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially disrupting service or causing instability. The vulnerability does not require user interaction but does require low-level privileges (a user account). The issue has been fixed in Qsync Central version 5.0.0.

CVE-2025-52870 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially leading to denial of service or other unintended behavior. The vulnerability requires low privileges (a user account) but no user interaction and has a low CVSS score of 0.6. QNAP has released a fix in version 5.0.

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.

Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote code execution

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT X-TRACK (Software/X-Track/USER/App/Utils/lv_img_png/PNGdec/src modules). This vulnerability is associated with program files inflate.C. This issue affects X-TRACK: through v2.7.

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects dlib: before v19.24.9.

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects azerothcore-wotlk: through v4.0.0.

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could enable arbitrary code execution on AVR-based Arduino boards. ### Patches - The Fix is included starting from the `1.8.7` release available from the following link [ArduinoCore-avr v1.8.7](https://github.com/arduino/ArduinoCore-avr) - The Fixing Commit is available at the following link [1a6a417f89c8901dad646efce74ae9d3ddebfd59](https://github.com/arduino/ArduinoCore-avr/pull/613/commits/1a6a417f89c8901dad646efce74ae9d3ddebfd59) ### References - [ASEC-26-001 ArduinoCore-avr vXXXX Resolves Buffer Overflow Vulnerability](https://support.arduino.cc/hc/en-us/articles/XXXXX) ### Credits - Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)

CVE-2025-68137 is a high-severity buffer overflow vulnerability in the EVerest everest-core EV charging software stack. Prior to version 2025.10.0, an integer overflow in the SdpPacket::parse_header() function causes incorrect buffer length calculations, leading to either an infinite loop or a stack buffer overflow depending on the server configuration. This issue is fixed in version 2025.10.0.

CVE-2026-22861 is a high-severity heap-based buffer overflow vulnerability in the iccDEV library versions prior to 2.3.1.2, specifically in the SIccCalcOp::Describe() function within IccProfLib/IccMpeCalc.cpp. This vulnerability arises from unchecked return values leading to improper memory handling when processing ICC color profiles. Exploitation requires no privileges but does require user interaction, such as opening a crafted ICC profile. Successful exploitation can result in full confidentiality, integrity, and availability compromise, including potential remote code execution. The vulnerability affects any software or systems that utilize vulnerable versions of iccDEV for ICC profile processing. Although no known exploits are currently in the wild, the high CVSS score (8.

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.