Vulnerability threats

Speex (libspeex) versions up to 1.2.1 contain an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw occurs due to improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted Speex data to corrupt memory and potentially crash applications.

A NULL pointer dereference vulnerability exists in libcss up to version 0.9.2 within the netsurf-browser project. This flaw occurs in the mq_parse_media_query() function when processing media lists that end with a trailing comma. An attacker can exploit this by serving a stylesheet with an @media or @import media list ending in a comma, causing the parser to crash.

VMime versions up to 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencoded MIME parts. An attacker can exploit this by sending crafted uuencode or x-uuencode MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.

VMime versions up to 0.9.2 contain a stack-based buffer overflow vulnerability in the uuEncoder::decode function. This flaw arises from an integer underflow triggered by crafted uuencoded MIME parts in emails. An attacker can send a specially crafted email with a uuencoded line whose length character is 'b' but is not a 'begin' line, leading to stack memory corruption. This can cause the application to crash or potentially allow remote code execution.

CVE-2026-116737 is a heap out-of-bounds read vulnerability in libphdi, a component of libyal. The flaw occurs in the function libphdi_data_files_get_extent_data_file_path, which incorrectly calculates buffer size by using the directory prefix length instead of the basename length. This can be triggered by a crafted Parallels disk image descriptor with a long directory prefix and a short basename, potentially causing a process crash or exposure of adjacent heap memory.

CVE-2026-116736 is a heap out-of-bounds read vulnerability in libpff up to version 20260926. The flaw occurs in the libpff_table_read_values_array function due to improper validation of a 7c column definition's values_array_size against the remaining buffer bytes. An attacker can exploit this by supplying a crafted PST, OST, or PAB file, causing applications to read adjacent heap memory or crash.

CVE-2026-116735 is an off-by-one bounds check vulnerability in libpff through version 20260926. It occurs in the function libpff_table_read_6c_record_entries and allows attackers to trigger a heap out-of-bounds read by supplying crafted PST, OST, or PAB files. This can lead to reading adjacent heap memory or application crashes in tools like pffexport or pypff.

flatcc versions up to 0.6.4 have an integer overflow vulnerability in the check_header function of the FlatBuffers verifier. On 32-bit builds, this flaw allows crafted buffer offsets to bypass bounds checks, leading to out-of-bounds reads before the buffer and potential process crashes.

CVE-2026-116733 is an out-of-bounds read vulnerability in flatcc versions up to 0.6.4. It occurs in the __flatcc_json_parser_number function when parsing JSON numbers ending with a decimal point. This flaw allows attackers to read beyond the input buffer, potentially causing application crashes.

libdwarf versions up to 2.3.3 contain a heap out-of-bounds read vulnerability in the dwarf_debug_addr_table() function. This flaw occurs because the function omits the table starting offset when validating the .debug_addr unit length. An attacker can exploit this by supplying a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read beyond the allocated heap buffer. This can lead to disclosure of adjacent heap memory or cause a crash in programs using libdwarf.

Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using a crafted FamiTracker module with a subsong count of two or more, causing a write beyond the subsong vector and potentially crashing the application when the module is opened.

Furnace versions up to 0.6.8.3 have an out-of-bounds heap read vulnerability in the DivEngine::loadFTM() function. This flaw occurs when importing FamiTracker modules with an unbounded DPCM note count, allowing crafted files to read beyond the noteMap array and cause a crash.

CVE-2026-116729 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 volumes. The flaw occurs in the function libfvde_encrypted_metadata_read_type_0x001a() due to an unbounded strlen call on embedded XML plist data that is not properly NUL-terminated. An attacker can craft a malicious FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read beyond the allocated heap buffer.

CVE-2026-116728 is a heap out-of-bounds read vulnerability in libfvde, a library for FileVault 2 Core Storage volumes. The flaw occurs because the size of XML plist data is not properly checked against the source metadata block, allowing an attacker to cause a buffer over-read. This can lead to application crashes when processing crafted volumes.

gbsplay versions up to 0.0.103 contain a heap out-of-bounds read vulnerability in the vgm_open() function. This occurs because the function processes VGM command streams without proper bounds checking, allowing a crafted VGM file with specific wait opcodes and missing a 0x66 terminator to cause a read beyond the allocated heap buffer, potentially crashing the player.

Gbsplay versions up to 0.0.103 have a heap out-of-bounds read vulnerability in the gbr_open() function within gbs.c. This occurs because the function does not properly verify the length of the input GBR file before scanning the ROM title field. An attacker can craft a GBR file sized between 0x21 and 0x162 bytes to trigger reading beyond the allocated heap buffer, potentially causing a crash or memory leakage.

An out-of-bounds read vulnerability exists in gbsplay through version 0.0.103 in the mapper_map() function. This flaw allows crafted .gbr, .gbs, or .gb files with malicious ROM bank indexes to cause the player to read beyond the allocated heap buffer, potentially crashing the application.

FLTK versions up to 1.4.5 have an integer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw causes the application to allocate an undersized pixel buffer based on file-supplied width and height values. An attacker can exploit this by providing a crafted BMP or ICO file with large dimensions, leading to heap buffer overflow and corruption of the application heap.

FLTK versions up to and including 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when processing BMP or ICO files with a colors_used field value exceeding 256, which overflows a 768-byte colormap array. Exploitation can lead to application crashes or potentially allow code execution.

CVE-2026-116590 is a vulnerability in the xerial snappy-java library prior to version 1.1.10.9. It involves improper validation of array indices in the Snappy.arrayCopy method, which allows passing negative or oversized offset and byteLength values to native memcpy calls. This can cause out-of-bounds reads or writes, potentially crashing the Java Virtual Machine (JVM). The issue affects methods like SnappyOutputStream.rawWrite and SnappyInputStream.rawRead that use this primitive. The vulnerability is fixed in version 1.1.10.9.