CWE-120: Buffer Overflow vulnerabilities

CVE-2026-76077 is a classic buffer overflow vulnerability in the ASN1SCC ASN.1 compiler for embedded systems, specifically in the XER tokenizer function NT() prior to version 4.7.0.1. The vulnerability arises from copying tag characters into a fixed-size buffer without proper length checks, allowing crafted XER messages to overwrite stack memory, cause crashes, hangs, or potentially enable code execution. This flaw is fixed in version 4.7.0.1.

CVE-2026-48173 is a classic buffer overflow vulnerability in the NAS message handler of the Samsung Semiconductor Exynos 850. It arises from improper validation of the length field in NAS messages, leading to memory corruption. The issue was fixed in September 2026. There are no known exploits in the wild and no CVSS score is provided.

Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

CVE-2026-120057 is a classic buffer overflow vulnerability in the PostgreSQL psqlODBC driver. The flaw occurs because psqlODBC copies data from a large-object read into the application's buffer using the length provided by the server without verifying that the buffer is large enough. This can allow a malicious or untrusted server, or a man-in-the-middle attacker, to overwrite adjacent memory in the client process. The vulnerability affects all psqlODBC versions before 18.00.0006 and can be triggered by fetching any large-object column.

CVE-2026-57191 is a high-severity classic stack-based buffer overflow vulnerability in Asterisk's res_pjsip_pubsub module. It occurs due to an unbounded sscanf call when parsing the MWI NOTIFY Message-Account field. An unauthenticated attacker can send a crafted packet to trigger this overflow, corrupting the transport and disabling all SIP functionality until the service is restarted. Fixed versions include Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-93857 is a critical stack-based buffer overflow vulnerability in WatchGuard Fireware OS's SIP proxy. It allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy using the SIP proxy. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS score of 9.2 reflects the potential for remote code execution without user interaction or privileges.

SOEM versions before 2.0.1 have an out-of-bounds write vulnerability during device configuration. The software writes configuration data to a fixed-size array without verifying the index against the maximum allowed size (EC_MAXFMMU). A malicious device presenting more configuration blocks than EC_MAXFMMU can cause memory corruption by writing beyond the array boundary, potentially disrupting subsequent operations.

CVE-2026-82944 is a high-severity out-of-bounds write vulnerability in RT-Labs AB's SOEM software versions 2.0.0 and earlier. It arises from improper handling of multi-segment data transfers, where the total size is only checked once initially, allowing a malicious device to overflow memory buffers by sending additional segments beyond the declared size. This flaw can enable an attacker to write controlled data beyond buffer boundaries, potentially leading to code execution. The issue is fixed in version 2.0.1.

A classic buffer overflow vulnerability (CWE-120) exists in TianoCore EDK2 BIOS that allows remote attackers to cause out-of-bounds writes and incorrect buffer size calculations. Exploiting this flaw can lead to arbitrary code execution and impact confidentiality, integrity, and availability of the system. The vulnerability is critical with a CVSS 4.0 score of 9.5.

CVE-2026-101103 is a classic buffer overflow vulnerability in the PEAK-System Device Driver Setup by HMS Networks. The flaw arises because the PCAN diagnostic call does not verify that the output buffer provided by the caller is sufficiently large to hold the output data. This can lead to a buffer overflow condition.

CVE-2026-11828 is a classic buffer overflow vulnerability in IBM MQ Operator affecting multiple versions up to 3.9.2 and some 9.4.x releases. It allows a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause denial of service in client applications that use asynchronous message consumption. The issue arises from improper validation of queue name length values. The vulnerability has a medium severity with a CVSS score of 5.9. A fix is available starting from version 3.4.0.

CVE-2026-11829 is a medium severity vulnerability in IBM MQ Operator involving a classic buffer overflow (CWE-120). It allows an authenticated attacker to cause a denial of service by exploiting improper validation of offset values in MQOPEN requests. The vulnerability affects multiple specific versions of IBM MQ Operator. No known exploits are reported in the wild. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity are not impacted, but availability can be disrupted.

CVE-2026-102693 is a critical buffer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.04. The flaw exists in the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function, which uses strcpy to copy an SSID without validating the destination buffer size. When the MODULE_ATWINC15X0_DYNAMIC_CONNECT feature is enabled, an attacker within Wi-Fi range can send a malformed or oversized SSID during scanning, leading to memory corruption. This can cause a hard fault, denial of service, or potentially allow code execution. The vulnerability is fixed in RIOT-OS version 2026.04.

CVE-2025-29897 is a buffer copy vulnerability in QNAP Systems Inc.'s Qsync Central that allows a remote attacker with a user account to modify memory or crash processes. The issue is fixed in Qsync Central version 5.0.0.4 and later. The vulnerability has a low severity score and requires low privileges to exploit.

CVE-2026-102176 is a high-severity buffer overflow vulnerability in the SDK service process of Juniper Networks Junos OS. It allows an unauthenticated network attacker to cause denial of service or potentially compromise the Routing Engine by sending crafted packets when the SDK service and a JDAF routing instance are enabled. The vulnerability affects multiple Junos OS versions prior to specific patch releases.

CVE-2026-53420 is a buffer overflow vulnerability in the Zoom Phone feature of Zoom Workplace Clients. It may allow an unauthenticated attacker to escalate privileges via network access. The vulnerability affects versions prior to 7.2.0. The CVSS score is 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.

AMI APTIOV contains vulnerabilities in BIOS where users may cause  “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

CVE-2026-15340 is a critical buffer overflow vulnerability in the lwIP SMTP client from Savannah. The client does not properly check the size of inputs, which can lead to memory corruption. This vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. It affects version 2.2.1 of the lwIP SMTP client. No patch or remediation information is currently provided.

CVE-2026-82895 is a high-severity buffer overflow vulnerability in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. It allows a remote attacker to execute arbitrary code due to improper handling of input size during buffer copy operations.