CVE-2026-17401 is a stack-based buffer overflow vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code on the affected system. The vulnerability has a high severity with a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability.
A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
CVE-2026-116567 is a stack-based buffer overflow vulnerability in FreeSWITCH's mod_rtmp module prior to version 1.11.2. The flaw occurs in the rtmp_handle_control() function, which uses an unbounded sprintf loop to render RTMP user-control messages into a fixed 200-byte stack buffer. Messages with a body of roughly 70 bytes or more can overflow the stack before any RTMP login, potentially crashing FreeSWITCH and terminating all active calls. The vulnerability requires no authentication and affects deployments that enable mod_rtmp, which is disabled by default. This issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116571 is a stack-based buffer overflow vulnerability in FreeSWITCH's mod_rtmp module prior to version 1.11.2. The flaw occurs in the rtmp_rtp2rtmpH264() function, which copies SPS and PPS values into a fixed stack buffer without validating their size, allowing an attacker to overflow the stack. This vulnerability affects only deployments that enable mod_rtmp and bridge RTP media into an RTMP leg, which is disabled by default. Exploitation can cause FreeSWITCH to abort and terminate all active calls. While code execution has not been demonstrated, builds lacking stack protection may allow limited stack writes. The issue is fixed in version 1.11.2.
CVE-2026-116570 is a stack-based buffer overflow vulnerability in FreeSWITCH versions prior to 1.11.2. The flaw occurs in the http_directory_auth() function, which encodes user credentials into a fixed 80-byte buffer without checking output length. Credentials longer than 57 characters can overflow the stack, potentially crashing FreeSWITCH and disrupting active calls. Exploitation requires only an unauthenticated client to specify an existing directory user on an exposed mod_xml_rpc HTTP listener, though this module is not loaded by default. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
CVE-2026-115928 is a stack-based buffer overflow vulnerability in FreeSWITCH prior to version 1.11.2. It occurs in the function switch_core_media_add_crypto() when processing the encoded key and salt length from an inbound SDP a=crypto attribute. A zero-length key and salt cause an underflow in the destination capacity, leading to a buffer overflow on the stack. This overflow can corrupt memory and crash the FreeSWITCH process, dropping all active calls. The vulnerability affects the shipped external profile accessible to unauthenticated callers and authenticated inbound calls on other profiles unless mitigated by configuration. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in mod_sofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
CVE-2026-94395 is a stack-based buffer overflow vulnerability in the Thales SafeNet Authentication Client (SAC) SIS token engine. It can be triggered by a malicious physical or software-emulated smart card before authentication or PIN entry. The flaw may lead to denial of service or potentially allow arbitrary code execution with the privileges of the affected process. The vulnerability affects SAC versions starting from 10.8 R7 up to and including 10.9 R3 GA (build 10.9.7449).
A stack-based buffer overflow vulnerability (CWE-121) exists in ntopng prior to version 6.7.260721. The flaw occurs in the function ndpi_get_custom_category_match, which writes a four-byte value into a two-byte variable during packet processing. This can be triggered remotely by an unauthenticated attacker on a monitored network segment by sending packets that match custom-category rules, leading to stack corruption and denial of service. The issue is fixed in version 6.7.260721.
A stack-based buffer overflow vulnerability exists in the lwIP DNS resolver component of Espressif's ESP-IDF framework versions 5.2.3 through certain pre-fixed versions. The flaw occurs when multiple DNS records are cached and copied into a single-element buffer without bounds checking, allowing an attacker controlling DNS responses to overwrite adjacent stack memory. This can lead to a device reboot or potential control flow hijacking if stack protection is not enabled. Fixed versions are available starting from 5.3.7, 5.4.5, 5.5.6, and 6.0.3.
A stack-based buffer overflow vulnerability exists in the OpenThread Border Router Neighbor Discovery packet handler of Espressif's ESP-IDF framework versions 5.2.0 through 5.2.7, 5.3.0 through 5.3.5, 5.4.0 through 5.4.4, 5.5.0 through 5.5.4, and 6.0.0 through 6.0.2. The flaw arises from trusting an attacker-controlled ICMPv6 option length, leading to an out-of-bounds write into adjacent stack memory. This affects firmware with the Border Router feature enabled (CONFIG_OPENTHREAD_BORDER_ROUTER=y). Exploitation requires no authentication or user interaction and can cause device crashes, reboots, or stack corruption. Fixed in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3.
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name.
Refer to the '
Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information.
CVE-2026-120067 is a stack-based buffer overflow vulnerability in the PostgreSQL psqlODBC driver affecting versions before 18.00.0006. The issue occurs when updatable cursors add hidden ctid and oid columns to queries and copy server-sent values into a fixed 32-byte stack buffer without proper length checks. This can lead to memory corruption or application abort depending on build settings. The vulnerability requires a server or database user capable of sending crafted data or creating views with specific column names. A fix is available in version 18.00.0006.
CVE-2026-120063 is a stack-based buffer overflow vulnerability in the PostgreSQL psqlODBC driver. It occurs when quoting schema or table names into a fixed 128-byte stack buffer, allowing writes up to two bytes beyond the buffer's end for long names. This overflow can corrupt the stack with a double quote and a null byte. The vulnerability affects versions before 18.00.0006 and arises from parsing SQL text that includes untrusted schema or table names. Exploitation requires forwarding untrusted SQL text to the driver.
CVE-2026-120061 is a stack-based buffer overflow vulnerability in the psqlODBC driver for PostgreSQL. The issue arises from improper handling of ODBC escape sequences in SQL text, where argument offsets for {fn} escapes are written into a fixed-size stack array without bounds checking. This can lead to stack overflow and memory corruption. Additionally, certain escape sequences ({d}, {t}, {ts}, {escape}) write one byte beyond a 128-byte stack buffer. Applications forwarding untrusted SQL text to the driver are at risk. Versions before 18.00.0006 are affected.
In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574.
CVE-2026-78403 is a critical stack-based buffer overflow and missing authorization vulnerability in Thalesgroup Sentinel Keys Server on Windows. The vulnerability arises because the server does not validate the length of the first field in an HTTP request. An attacker can exploit this flaw by sending a crafted HTTP request, potentially leading to remote code execution with NT AUTHORITY\SYSTEM privileges. This affects Sentinel Keys Server versions prior to 1.3.8.0.
CVE-2026-78402 is a stack-based buffer overflow vulnerability in Thalesgroup Sentinel Keys Server on Windows. The vulnerability arises because the software does not properly validate the length of the first field in an input message. A local attacker can exploit this flaw by crafting a malicious input to trigger a buffer overflow, potentially leading to arbitrary code execution with NT AUTHORITY\SYSTEM privileges, enabling local privilege escalation. This affects versions prior to 1.3.8.0. The issue has been fixed in version 1.3.8.0.