CVE-2026-52787 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. It involves an incorrect calculation of buffer size leading to a reachable out-of-bounds write when encoding the device.address-binding property. This flaw affects versions prior to 1.4.5, 1.5.1, and 1.6.0-rc2. The issue has been fixed in these versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.
Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux.
This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.
CVE-2026-116788 is a heap-based buffer overflow vulnerability in FreeSWITCH before version 1.11.2. It arises from an integer underflow in the switch_xml_decode() function when processing XML entities with empty replacement values, leading to undersized heap allocation and subsequent buffer overflow. An unauthenticated attacker can exploit this by sending a crafted SIP PUBLISH request to a SIP profile with presence management and DTD processing enabled. Successful exploitation can corrupt heap memory and cause the FreeSWITCH process to terminate, disrupting all active calls. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116570 is a stack-based buffer overflow vulnerability in FreeSWITCH versions prior to 1.11.2. The flaw occurs in the http_directory_auth() function, which improperly encodes user credentials into a fixed-size buffer without checking output length. This can cause a stack overflow when credentials exceed 57 characters, leading to a crash of FreeSWITCH and termination of all active calls. The vulnerability requires only that an unauthenticated client specify an existing directory user on an exposed mod_xml_rpc HTTP listener, though this module is not loaded by default. Remote code execution has not been demonstrated. The issue is fixed in version 1.11.2.
CVE-2026-57192 is a medium severity vulnerability in Asterisk's Codec2 decoder that allows an authenticated attacker to cause a heap buffer overflow via an out-of-bounds write triggered by a floor/ceil sample-count mismatch. The attacker must authenticate via SIP and establish a call using Codec2 to exploit this flaw. The issue affects multiple versions of Asterisk prior to fixed releases and requires the codec_codec2 module to be loaded and configured on the target endpoint. Fixed versions are available.
CVE-2026-112709 is a critical heap-based buffer overflow vulnerability in the WatchGuard Fireware OS authentication service. An attacker who can control or intercept traffic to the configured Active Directory server can exploit this flaw by sending a specially crafted response. This can lead to denial of service and potentially arbitrary code execution. The vulnerability affects multiple version ranges of Fireware OS and has been fixed in versions 2026.4, 12.12.4, and 12.5.22.
CVE-2026-112710 is a critical heap-based buffer overflow vulnerability in the WatchGuard Fireware OS authentication service. It allows an attacker who can control or intercept traffic to the configured Active Directory server to cause denial of service and potentially execute arbitrary code by sending a specially crafted response. The flaw affects multiple versions of Fireware OS prior to 2026.4, 12.12.4, and 12.5.22. A fix is available in these versions.
CVE-2026-107590 is an out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding within the Qt 5 Compatibility APIs module. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, potentially causing application crashes and affecting data integrity. The vulnerability affects Qt versions from 4.5.0 through 6.8.8 and from 6.9.0 through 6.11.2. The CVSS 4.0 base score is 1.9, indicating a low severity issue. There are no known exploits in the wild and no patch information is provided in the source data.
CVE-2026-82944 is a high-severity out-of-bounds write vulnerability in RT-Labs AB's SOEM software versions 2.0.0 and earlier. It arises from improper handling of multi-segment data transfers, where the total size is only checked once initially, allowing a malicious device to overflow memory buffers by sending additional segments beyond the declared size. This flaw can enable an attacker to write controlled data beyond buffer boundaries, potentially leading to code execution. The issue is fixed in version 2.0.1.
A classic buffer overflow vulnerability (CWE-120) exists in TianoCore EDK2 BIOS that allows remote attackers to cause out-of-bounds writes and incorrect buffer size calculations. Exploiting this flaw can lead to arbitrary code execution and impact confidentiality, integrity, and availability of the system. The vulnerability is critical with a CVSS 4.0 score of 9.5.
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes.
The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied.
A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.
CVE-2026-92156 is a vulnerability in NASA's F Prime framework prior to version 4.3.0. It involves incorrect calculation of buffer size in the EventManager's log queue internal interface handler. The issue arises because EventManager accepts log buffers up to the maximum size but does not properly account for metadata overhead, leading to serialization failures and assertion triggers. This can cause a denial of service by aborting or resetting the process when a legal bridged event payload exceeds the remaining log-argument budget. The vulnerability is fixed in version 4.3.0.
CVE-2026-102027 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves an incorrect calculation of buffer size (CWE-131) that can be triggered by a configured eBGP neighbor sending BGP labeled-unicast UPDATE messages when certain multipath features are enabled. This vulnerability can cause the rpd process to crash, resulting in denial of service. The issue affects multiple specific version ranges of Junos OS and Junos OS Evolved. No known exploits in the wild have been reported, and no explicit patch links are provided in the input data.
CVE-2026-102505 is a medium severity vulnerability in Imager versions before 1.037 for Perl. It involves an incorrect calculation of buffer size when fetching float samples from a paletted image, leading to a heap buffer overflow. Specifically, requesting more than one channel causes writes past the allocated buffer end, controlled by attacker-supplied image palette data.
CVE-2026-47578 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows. It involves an incorrect calculation of buffer size in the kernel mode layer. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No specific affected versions or patch information is provided.
`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.
Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.
Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers.
This issue affects Trusted Firmware: through socfpga_v2.14.0.