Threats Tagged 'cwe-127'

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

CVE-2026-5928 is a high-severity buffer under-read vulnerability in the GNU C Library (glibc) versions 2. 43 and earlier. It occurs when the ungetwc function is called on a FILE stream containing wide characters encoded in a character set with overlapping single-byte and multi-byte encodings. This flaw can cause the function to read memory before the allocated buffer, potentially leading to program crashes or unintended disclosure of adjacent heap data. The vulnerability arises from a bug in the wide character pushback implementation, where ungetwc operates on the wrong buffer pointer. This issue requires a specific character encoding scenario and does not affect standard Unicode character sets. No official patch or remediation has been confirmed yet.