CVE-2026-104267 is an out-of-bounds write vulnerability in the Botan cryptography library's Scrypt implementation on 32-bit platforms. Versions from 2.7.0 up to but not including 3.13.0 are affected. The flaw arises from unchecked multiplication when computing required memory, allowing attacker-controlled parameters to cause buffer overflow. This can lead to process crashes and denial of service. While arbitrary code execution has not been demonstrated, it cannot be ruled out. The issue is fixed in Botan version 3.13.0.
In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.
LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.
CVE-2026-116783 is a high-severity vulnerability in FreeSWITCH prior to version 1.11.2. It involves improper validation of an array index in the udptl_rx_packet() function within the mod_spandsp T.38 fax session handler. A peer can send a larger-than-expected FEC entry count, causing memory corruption by writing beyond fixed-size arrays. This can crash FreeSWITCH and terminate all active calls. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116781 is an off-by-one error vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the ws_read_frame() function when unmasking WebSocket payloads, potentially causing writes up to 14 bytes beyond the receive buffer and a terminating NUL byte one byte out of bounds. This vulnerability is reachable before authentication if mod_xml_rpc and its WebSocket endpoint are enabled, though these features are disabled by default. The out-of-bounds writes remain within the same connection handle's adjacent outbound buffer, and no process crash or cross-session data disclosure has been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116785 is a heap-based buffer overflow vulnerability in FreeSWITCH prior to version 1.11.2. The flaw arises from improper handling of a WebSocket frame's extended payload length in the ws_read_frame() function, which leads to memory overwrite beyond the allocated receive buffer. This vulnerability can cause FreeSWITCH to crash, terminating all concurrent sessions. The vulnerable code path is reachable before HTTP authentication on the mod_xml_rpc WebSocket endpoint, which is disabled by default. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116570 is a stack-based buffer overflow vulnerability in FreeSWITCH versions prior to 1.11.2. The flaw occurs in the http_directory_auth() function, which encodes user credentials into a fixed 80-byte buffer without checking output length. Credentials longer than 57 characters can overflow the stack, potentially crashing FreeSWITCH and disrupting active calls. Exploitation requires only an unauthenticated client to specify an existing directory user on an exposed mod_xml_rpc HTTP listener, though this module is not loaded by default. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116569 is an integer underflow vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the msrp_parse_buffer() function, which subtracts delimiter framing from a peer-controlled short segment without verifying its length, causing an unsigned integer wraparound. This leads to memory corruption and potential crashes when processing MSRP TCP or TLS connections before authentication. The listener is disabled by default, but enabling MSRP ports exposes this risk. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
CVE-2026-116574 is an off-by-one error vulnerability in FreeSWITCH prior to version 1.11.2. The function switch_xml_ampencode() reserved insufficient space for a terminating NUL byte when encoding four-byte UTF-8 sequences, causing a one-byte heap overflow when serializing remote-supplied text at a buffer boundary. This flaw affects multiple XML serialization outputs that handle caller-controlled values. The issue can cause process aborts or memory corruption but has not been shown to enable remote code execution. The vulnerability is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in mod_sofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
CVE-2026-94395 is a stack-based buffer overflow vulnerability in the Thales SafeNet Authentication Client (SAC) SIS token engine. It can be triggered by a malicious physical or software-emulated smart card before authentication or PIN entry. The flaw may lead to denial of service or potentially allow arbitrary code execution with the privileges of the affected process. The vulnerability affects SAC versions starting from 10.8 R7 up to and including 10.9 R3 GA (build 10.9.7449).
CVE-2026-54912 is a high-severity out-of-bounds write vulnerability in the WebAssembly Micro Runtime (WAMR) versions prior to 2.4.5. It arises from inconsistent constant-table handling between two passes of the fast interpreter loader, leading to heap buffer overflow during module loading. This can corrupt host heap metadata and cause a deterministic crash, resulting in denial of service. The issue affects builds with the fast interpreter enabled (WAMR_BUILD_FAST_INTERP=1) and is fixed in version 2.4.5.
CVE-2026-76077 is a classic buffer overflow vulnerability in the ASN1SCC ASN.1 compiler for embedded systems, specifically in the XER tokenizer function NT() prior to version 4.7.0.1. The vulnerability arises from copying tag characters into a fixed-size buffer without proper length checks, allowing crafted XER messages to overwrite stack memory, cause crashes, hangs, or potentially enable code execution. This flaw is fixed in version 4.7.0.1.
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
CVE-2026-70659 is a high-severity out-of-bounds write vulnerability in the leejet stable-diffusion.cpp library. It arises from improper handling of vectors in the IMatrixCollector::load_imatrix function, allowing an untrusted .imatrix file to cause heap corruption or process crashes before model loading. The issue is fixed in version master-763-4fcc6fe.
CVE-2026-35494 is an out-of-bounds write vulnerability (CWE-787) in the Samsung Semiconductor Exynos 1280 baseband. It occurs during NAS packet processing and can lead to memory corruption causing a denial of service. A fix for this vulnerability was released in October 2026.
CVE-2026-68985 is an out-of-bounds write vulnerability in the Samsung Exynos 1280 NPU driver caused by improper validation of user input in the ioctl handler. This flaw can lead to a denial of service condition. A fix for this vulnerability was released in November 2026.
CVE-2026-69068 is an out-of-bounds write vulnerability in the GNSS firmware loader of the Samsung Semiconductor Exynos Modem 5300. It is caused by insufficient length validation, which may lead to corruption of kernel memory. A fix is available as of November 2026.
CVE-2026-68991 is an out-of-bounds write vulnerability in the Samsung Exynos ENN NeuralNetworks HAL component of the Exynos 1480 chipset. Improper input validation during request processing can cause memory corruption, potentially leading to a denial of service condition. A fix for this vulnerability is available as of November 2026.