CVE-2026-113364 is a critical heap-based buffer overflow vulnerability in NEC Corporation WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows. It allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges by sending a crafted packet containing a malformed data size value in the protocol header.
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
CVE-2026-82308 is a pre-authentication heap-based buffer overflow vulnerability in the SonicWall SonicOS SSL-VPN service. This flaw could allow a remote unauthenticated attacker to cause an application-level denial of service, disrupting the availability of the affected service.
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.
To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
CVE-2026-116788 is a heap-based buffer overflow vulnerability in FreeSWITCH before version 1.11.2. It arises from an integer underflow in the switch_xml_decode() function when processing XML documents with entities that have empty replacement values. An unauthenticated attacker can exploit this by sending a crafted SIP PUBLISH request to a SIP profile with presence management and DTD processing enabled, causing heap memory corruption and process termination, disrupting active calls. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116785 is a heap-based buffer overflow vulnerability in FreeSWITCH prior to version 1.11.2. The flaw arises from improper handling of a WebSocket frame's extended payload length in the ws_read_frame() function, which leads to memory overwrite beyond the allocated receive buffer. This vulnerability can cause FreeSWITCH to crash, terminating all concurrent sessions. The vulnerable code path is reachable before HTTP authentication on the mod_xml_rpc WebSocket endpoint, which is disabled by default. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
A heap-based buffer overflow vulnerability exists in WebAssembly Micro Runtime (WAMR) versions prior to 2.4.5. The flaw occurs in the wasi_poll_oneoff function, which incorrectly validates the output pointer for only one event, while the underlying code can write multiple events based on a guest-controlled value. This mismatch allows a crafted guest module to overwrite adjacent host heap memory, potentially causing a crash or further confidentiality and integrity issues depending on heap layout. The issue is fixed in version 2.4.5.
CVE-2026-112109 is a local privilege escalation vulnerability in Thales SafeNet Authentication Client Service (SACSrv). It allows an authenticated, non-administrator local user to trigger a heap-based buffer overflow via the service interface. Exploitation can lead to arbitrary code execution with Local System privileges. This affects SAC versions up to and including 10.9 R3 GA (build 10.9.7449).
CVE-2026-62365 is a heap-based buffer overflow vulnerability in the Wazuh security platform affecting versions from 3.9.0 up to but not including 4.14.7. The flaw occurs in the DecodeWinevt function when processing Windows EventChannel Data elements, allowing an enrolled agent to cause a buffer overflow by submitting crafted EventChannel messages. This overflow corrupts heap metadata and leads to a crash of the wazuh-analysisd process, disrupting log ingestion for all agents managed by the affected instance. The issue is fixed in version 4.14.7.
CVE-2026-12550 is a heap-based buffer overflow vulnerability in IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. This flaw arises from improper validation of message selection parameters and could allow an authenticated attacker to obtain sensitive information or cause a denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.4.
A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
A heap-based buffer overflow vulnerability exists in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2. This flaw allows an unauthenticated remote attacker to crash the index.cgi process by sending a crafted multipart/form-data POST request with an excessively long Content-Disposition name field. The vulnerability affects console server appliances and has a high severity rating.
CVE-2026-9536 is a heap-based buffer overflow vulnerability in the vtkWindBladeReader FindVariableOffsets functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted .wind file, potentially causing a buffer overflow condition.
CVE-2026-96199 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 154.0.4258.37. An official fix is available in version 154.0.4258.37. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-96198 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue. The vulnerability has a high severity rating with a CVSS score of 8.8.
CVE-2026-85897 is a heap-based buffer overflow vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has released an official fix in version 154.0.4258.37 to address this issue.
CVE-2026-118611 is a heap-based buffer overflow vulnerability in the Bluetooth OBEX packet handling of Alpine iLX-F511 devices. It allows an attacker with physical proximity to execute arbitrary code with root privileges without requiring authentication. The flaw arises from improper validation of user-supplied data length before copying to a heap buffer.