Threats Tagged 'cwe-1285'

CVE-2026-31912 is a medium severity vulnerability in libpcap's BPF interpreter where improper validation of filter program offsets can cause out-of-bounds memory reads. Specifically, the interpreter does not detect reaching the end of the filter buffer without a return instruction or jumps to offsets outside the buffer. This can lead to reading large areas of OS process memory on both 32-bit and 64-bit architectures.

RaTeX, a Rust-based KaTeX-compatible math rendering engine, has a vulnerability prior to version 0.1.11 where its parser panics on specific malformed input containing a multibyte UTF-8 delimiter in the \verb command. This panic causes the entire process to abort, resulting in a denial of service. The issue is fixed in version 0.1.11.

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition.

There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver.  This may allow a local, authenticated user to escalate privileges and execute arbitrary code.  This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows.

## Summary `parseEfiSignatureList()` in `attest/internal/events.go` does not skip `SignatureHeaderSize` vendor bytes before reading `EFI_SIGNATURE_LIST` signature entries, violating UEFI specification section 31.4.1. ## Impact For `hashSHA256SigGUID` lists, attacker-controlled vendor header bytes are appended directly to the trusted SHA256 hash list. A crafted TPM event log can inject arbitrary SHA256 hashes into the verifier's trusted measurement database, allowing a remote attestation verifier to accept a compromised boot state as legitimate — breaking the core integrity guarantee of remote attestation. ## Root Cause After `binary.Read(&signatures.Header)` reads 28 bytes, `buf` points to the start of the `SignatureHeaderSize` vendor bytes. Both entry loops start at `sigOffset := 0` instead of `sigOffset := SignatureHeaderSize`, causing vendor bytes to be read as signature entries. ## Affected versions All versions through commit `f877374` (2026-05-15). ## Fix Pull request: https://github.com/google/go-attestation/pull/502 - Add bound check: `SignatureHeaderSize` must not exceed remaining list space - Skip `SignatureHeaderSize` bytes before both entry loops - Regression test: `TestParseEfiSignatureListNonZeroSignatureHeaderSize`

A security update for Red Hat build of Apache Camel 4.18 for Quarkus 3.33 is now available and includes the following CVE fixes: * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [rhboac-camel-quarkus-3] (CVE-2026-45416) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation [rhboac-camel-quarkus-3] (CVE-2026-45674) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass [rhboac-camel-quarkus-3] (CVE-2026-50010) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records [rhboac-camel-quarkus-3] (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers [rhboac-camel-quarkus-3] (CVE-2026-48059) * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak [rhboac-camel-quarkus-3] (CVE-2026-48043) * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message [rhboac-camel-quarkus-3] (CVE-2026-44893) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation [rhboac-camel-quarkus-3] (CVE-2026-44249) * quarkus-vertx-http: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities [rhboac-camel-quarkus-3] (CVE-2026-50559) * libthrift: Apache Thrift: Denial of Service via excessive memory allocation [rhboac-camel-quarkus-3] (CVE-2026-43868) * libthrift: Apache Thrift: Security bypass due to improper certificate validation [rhboac-camel-quarkus-3] (CVE-2026-43869)

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.