CWE-122
CWE-122 · 558 records · 81 with a public proof-of-concept
Records the NVD classes under CWE-122, highest CVSS first.
- CRITICAL 10CVE-2026-89126
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Success…
- CRITICAL 10CVE-2026-123966public PoC
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possib…
- CRITICAL 10CVE-2026-110958
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made pub…
- CRITICAL 9.8CVE-2026-124560public PoC
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be init…
- CRITICAL 9.8CVE-2026-123614public PoC
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips…
- CRITICAL 9.8CVE-2026-119923public PoC
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS command…
- CRITICAL 9.8CVE-2026-114549
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. Th…
- CRITICAL 9.8CVE-2026-86574
Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Base: from 11-00 before 12-50-54.
- CRITICAL 9.8CVE-2026-82120
Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB…
- CRITICAL 9.8CVE-2026-76939
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- CRITICAL 9.8CVE-2026-78846public PoC
Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.
- CRITICAL 9.8CVE-2026-111183
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnera…
- CRITICAL 9.8CVE-2026-102175
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as…
- CRITICAL 9.8CVE-2026-101950
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packe…
- CRITICAL 9.8CVE-2026-97815
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-97814
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-97016
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- CRITICAL 9.8CVE-2026-96909
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2022
- CRITICAL 9.8CVE-2026-96320
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- CRITICAL 9.8CVE-2026-96113
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- CRITICAL 9.8CVE-2026-96096
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-85928
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-85814
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-85809
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-84015
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-83935
Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-83782
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-83770
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-83748
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-83693
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-83578
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-83519
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-83517
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-70291
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- CRITICAL 9.8CVE-2026-70242
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- CRITICAL 9.8CVE-2026-70157
Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-70153
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-70147
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-70096
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-69886
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-69639
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-69634
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-102210
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-100222
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-103501public PoC
Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of ent…
- CRITICAL 9.8CVE-2026-14269
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overf…
datapower gateway
- CRITICAL 9.8CVE-2026-76471
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due t…
- CRITICAL 9.8CVE-2026-94127
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Depl…
big-ip access policy manager
- CRITICAL 9.8CVE-2016-15059public PoC
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. …
- CRITICAL 9.8CVE-2026-81642
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA …
unbound
- CRITICAL 9.8CVE-2017-20241
Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to crash the endpoint or potentially execute arbitrary code.
- CRITICAL 9.6CVE-2026-121247
Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.6CVE-2026-121156
Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome
- CRITICAL 9.6CVE-2026-121086
Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- CRITICAL 9.6CVE-2026-119261
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- CRITICAL 9.6CVE-2026-110152
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.6CVE-2026-102331
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.6CVE-2026-95350public PoC
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.6CVE-2026-95349
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.6CVE-2026-95318
Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- CRITICAL 9.6CVE-2026-95284
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.6CVE-2026-95283
Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · android
- CRITICAL 9.6CVE-2026-95281
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
chrome · android
- CRITICAL 9.4CVE-2026-86576
Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 …
- CRITICAL 9.4CVE-2026-76937
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- CRITICAL 9.4CVE-2026-76933
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- CRITICAL 9.1CVE-2026-116785public PoC
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() decoded a WebSocket frame's 64-bit extended …
- CRITICAL 9.1CVE-2026-10136
A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticat…
- CRITICAL 9.1CVE-2026-101307
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffe…
freebsd
- HIGH 8.8CVE-2026-121958public PoC
FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious …
freerdp
- HIGH 8.8CVE-2026-121180
Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-121113public PoC
Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-121047
Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- HIGH 8.8CVE-2026-96199
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
edge chromium
- HIGH 8.8CVE-2026-96198
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
edge chromium
- HIGH 8.8CVE-2026-85897
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
edge chromium
- HIGH 8.8CVE-2026-116837
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
- HIGH 8.8CVE-2026-92208
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. …
- HIGH 8.8CVE-2026-114045public PoC
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORM…
- HIGH 8.8CVE-2026-10574
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
mq operator · supplied mq advanced container images
- HIGH 8.8CVE-2026-10572
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
mq operator · supplied mq advanced container images
- HIGH 8.8CVE-2026-108451
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-108450
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-108449
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-108447
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-108444
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-108441
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108439
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108437
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108432
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108430
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108429
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108428
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108427
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108426
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-63626public PoC
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6…
- HIGH 8.8CVE-2026-103994
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.
- HIGH 8.8CVE-2026-102015
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an …
- HIGH 8.8CVE-2026-110166
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-110155
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-94512
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-102855
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-97780
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97777
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97776
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97773
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97769
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97768
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97766
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97765
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97763
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97758
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97757
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97756
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97754
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97753
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97751
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97748
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97741
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-97739
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97007
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97004
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-97003
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-96952
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 8.8CVE-2026-96943
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
raw image extension · windows 11 21h2 · windows 11 26h2 · windows 10 1507 · windows 10 1607 · windows 10 1809
- HIGH 8.8CVE-2026-96917
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 8.8CVE-2026-96914
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- HIGH 8.8CVE-2026-96913
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 8.8CVE-2026-96202
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-88202
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-88197
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-88196
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-88186
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-88163
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
sharepoint server
- HIGH 8.8CVE-2026-88157
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-88155
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
sharepoint server
- HIGH 8.8CVE-2026-88145
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-88142
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-85936
Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-85931
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-85905
Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.
- HIGH 8.8CVE-2026-85339
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
- HIGH 8.8CVE-2026-83874
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-83851
Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-83789
Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-83778
Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-83777
Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.
- HIGH 8.8CVE-2026-83725
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-83716
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
- HIGH 8.8CVE-2026-83688
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-83523
Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-77902
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-77496
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70343
Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70302
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-70301
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-70287
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-70282
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-70268
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-70262
Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-70258
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70257
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-70256
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · office 2024
- HIGH 8.8CVE-2026-70210
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-70149
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
- HIGH 8.8CVE-2026-70089
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70068
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-69985
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-69918
Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.8CVE-2026-69326
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-108467
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-105717
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105716
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105598
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105597
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105596
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105593
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-105591
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-102858
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
microsoft 365 · office 2021 · office 2024
- HIGH 8.8CVE-2026-102857
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-102856
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-102850
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-102849
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 8.8CVE-2026-100220
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-100210
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- HIGH 8.8CVE-2026-58835
In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
android
- HIGH 8.8CVE-2026-103631
Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-94424
A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be…
- HIGH 8.8CVE-2026-69486
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- HIGH 8.5CVE-2026-85886
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- HIGH 8.5CVE-2026-68883
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- HIGH 8.5CVE-2026-67625
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- HIGH 8.4CVE-2026-58995
In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- HIGH 8.4CVE-2026-58871
In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…
- HIGH 8.3CVE-2026-106292
Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- HIGH 8.3CVE-2026-106247
Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
chrome
- HIGH 8.3CVE-2026-93962public PoC
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer…
- HIGH 8.2CVE-2026-116788public PoC
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent …
- HIGH 8.1CVE-2026-125401public PoC
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field…
- HIGH 8.1CVE-2026-121997
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual…
- HIGH 8.1CVE-2026-111441
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s()…
- HIGH 8.1CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same res…
- HIGH 8.1CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achie…
- HIGH 8.1CVE-2026-88185
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.1CVE-2026-70269
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 8.1CVE-2026-70038
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.1CVE-2026-14888
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
datapower gateway
- HIGH 8.1CVE-2026-46570public PoC
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading th…
ntfs-3g
- HIGH 8.1CVE-2026-14316
The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
- HIGH 8.1CVE-2026-95389
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- HIGH 8.1CVE-2026-95387
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- HIGH 8CVE-2026-69363
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.
- HIGH 7.8CVE-2026-125250public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing re…
- HIGH 7.8CVE-2026-121941public PoC
libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data by…
- HIGH 7.8CVE-2026-59267
A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
openoffice
- HIGH 7.8CVE-2026-120431
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table le…
- HIGH 7.8CVE-2026-93523
A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- HIGH 7.8CVE-2026-93522
A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
- HIGH 7.8CVE-2026-93521
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
- HIGH 7.8CVE-2026-93520
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server c…
- HIGH 7.8CVE-2026-93519
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- HIGH 7.8CVE-2026-93518
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
- HIGH 7.8CVE-2026-108307
Tanium addressed a heap-based buffer overflow vulnerability in Index.
- HIGH 7.8CVE-2026-55246public PoC
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes e…
- HIGH 7.8CVE-2026-101927
A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messa…
- HIGH 7.8CVE-2026-95638
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- HIGH 7.8CVE-2026-104348
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-97804
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-97803
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
windows 11 26h1
- HIGH 7.8CVE-2026-97794
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2022
- HIGH 7.8CVE-2026-97009
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
365 apps · office 2021 · office 2024
- HIGH 7.8CVE-2026-97001
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 7.8CVE-2026-96996
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
365 apps · office 2021 · office 2024
- HIGH 7.8CVE-2026-96929
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
windows server 2022 · windows server 2025
- HIGH 7.8CVE-2026-96920
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96916
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96856
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96843
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96318
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96312
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96217
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88193
Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88168
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-88147
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-88128
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-88118
Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-88093
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-87707
Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-87706
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-87699
Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85927
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85915
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-85908
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85902
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85901
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85871
Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85869
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85867
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85848
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85832
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85822
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85820
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85800
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85373
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85368
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85366
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85358
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85341
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-85327
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85318
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83932
Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83931
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-83920
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83919
Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-83903
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83902
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83896
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83882
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83881
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83867
Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83863
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83861
Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83850
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83847
Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83836
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
- HIGH 7.8CVE-2026-83833
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83830
Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83829
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83828
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83783
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83779
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83768
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83758
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-83757
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83753
Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83709
Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83698
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83692
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83691
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83678
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83652
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83650
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83641
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83640
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-83639
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83638
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83588
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83579
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83569
Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83518
Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83514
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83513
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-78459
Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70286
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70285
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70278
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70255
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70238
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70233
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70220
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 7.8CVE-2026-70143
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-70139
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70138
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70132
Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70131
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70123
Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70121
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70117
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70114
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70112
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-70109
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70108
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70106
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70103
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70093
Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70092
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70060
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70059
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70054
Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70052
Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-70048
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70027
Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1
- HIGH 7.8CVE-2026-70015
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-70010
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69963
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69949
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69909
Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-69898
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.8CVE-2026-69633
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69471
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69354
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-68836
Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-108130
Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-105003
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-104344
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- HIGH 7.8CVE-2026-104340
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- HIGH 7.8CVE-2026-103966
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- HIGH 7.8CVE-2026-103568
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-102227
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
- HIGH 7.8CVE-2026-102218
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-102215
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-102205
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-100215
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
- HIGH 7.8CVE-2026-103010
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their …
- HIGH 7.8CVE-2026-92368
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bou…
- HIGH 7.8CVE-2026-86926
A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed i…
- HIGH 7.8CVE-2026-75665
Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
bridge
- HIGH 7.8CVE-2026-75649
Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
bridge · macos · windows
- HIGH 7.8CVE-2026-81474
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- HIGH 7.7CVE-2026-46569public PoC
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a…
ntfs-3g
- HIGH 7.5CVE-2026-123999public PoC
NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads …
- HIGH 7.5CVE-2026-82308
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
- HIGH 7.5CVE-2026-121964public PoC
FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capa…
freerdp
- HIGH 7.5CVE-2026-120208public PoC
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file…
- HIGH 7.5CVE-2026-9536
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerab…
- HIGH 7.5CVE-2026-109090
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- HIGH 7.5CVE-2026-109089
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
- HIGH 7.5CVE-2026-112021public PoC
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted applicati…
- HIGH 7.5CVE-2026-108448
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 7.5CVE-2026-96071
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.5CVE-2026-88207
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 7.5CVE-2026-87716
Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7.5CVE-2026-83795
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
- HIGH 7.5CVE-2026-83754
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- HIGH 7.5CVE-2026-70207
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.
- HIGH 7.5CVE-2026-70095
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- HIGH 7.5CVE-2026-70031
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.5CVE-2026-69789
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
- HIGH 7.5CVE-2026-105714
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 7.5CVE-2026-105599
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
365 apps · microsoft 365 · office 2021 · office 2024
- HIGH 7.5CVE-2026-105592
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- HIGH 7.5CVE-2026-107161
A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size whe…
- HIGH 7.5CVE-2026-88806
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
- HIGH 7.5CVE-2026-89028
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can …
- HIGH 7.5CVE-2026-81634
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check…
- HIGH 7.5CVE-2026-67860public PoC
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.
- HIGH 7.4CVE-2026-46572public PoC
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a fil…
ntfs-3g
- HIGH 7.3CVE-2026-111381public PoC
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with over…
- HIGH 7.3CVE-2026-111379public PoC
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the s…
- HIGH 7.3CVE-2026-92399public PoC
A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow…
- HIGH 7.2CVE-2026-120775
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
- HIGH 7.2CVE-2026-85798
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.2CVE-2026-108399
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- HIGH 7.2CVE-2026-87679
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An a…
fabric operating system
- HIGH 7.2CVE-2026-81477
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
- HIGH 7.1CVE-2025-71436public PoC
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Q…
- HIGH 7.1CVE-2026-79828
A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
- HIGH 7.1CVE-2026-79827
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
- HIGH 7.1CVE-2026-79826
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
- HIGH 7.1CVE-2026-79825
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
- HIGH 7.1CVE-2026-79822
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.
- HIGH 7.1CVE-2026-110837public PoC
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can …
- HIGH 7.1CVE-2026-85856
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.
- HIGH 7.1CVE-2026-74045public PoC
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministi…
- HIGH 7.1CVE-2026-42618public PoC
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the…
ntfs-3g
- HIGH 7.1CVE-2026-42617public PoC
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g.,…
ntfs-3g
- HIGH 7.1CVE-2026-103242
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, he…
- HIGH 7CVE-2026-91760
Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.
- HIGH 7CVE-2026-125260public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resoluti…
- HIGH 7CVE-2026-125235public PoC
FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows…
- HIGH 7CVE-2026-125218public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOS…
- HIGH 7CVE-2026-125214public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size,…
- HIGH 7CVE-2026-125212public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcode…
- HIGH 7CVE-2026-125204public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() in libwebpenc_common.c that lets attackers corrupt memory when cr_threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to writ…
- HIGH 7CVE-2026-125196public PoC
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose …
- HIGH 7CVE-2026-112109
A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow ar…
- HIGH 7CVE-2026-65168
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
- HIGH 7CVE-2026-88082
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85919
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-97810
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2022 · windows server 2025
- HIGH 7CVE-2026-96868
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-88110
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85943
Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85870
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85834
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85828
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85827
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85791
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-85365
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-84014
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-83921
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83911
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83871
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83827
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83775
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83750
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83724
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83680
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83676
Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83580
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-69970
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-109453
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-103555
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-102209
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-102191
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-102189
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-100225
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-100203
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-100201
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-35001
OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In t…
- MEDIUM 6.8CVE-2026-118611
Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication…
- MEDIUM 6.8CVE-2026-116488public PoC
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descripto…
- MEDIUM 6.8CVE-2026-96863
Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.8CVE-2026-83895
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.8CVE-2026-69958
Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.8CVE-2026-69947
Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack.
windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1
- MEDIUM 6.8CVE-2026-102206
Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.8CVE-2026-109255public PoC
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large sco…
- MEDIUM 6.7CVE-2026-88089
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
- MEDIUM 6.7CVE-2026-70189
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
- MEDIUM 6.7CVE-2026-96938
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.7CVE-2026-88143
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
- MEDIUM 6.6CVE-2026-79831
A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.
- MEDIUM 6.6CVE-2026-83945
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- MEDIUM 6.6CVE-2026-69635
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.5CVE-2026-125393
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer. Attackers can supply an X-FB-USER address longer than about 1016 bytes,…
- MEDIUM 6.5CVE-2026-123205public PoC
accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-ran…
- MEDIUM 6.5CVE-2026-121950public PoC
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A …
freerdp
- MEDIUM 6.5CVE-2026-121602public PoC
Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sp…
- MEDIUM 6.5CVE-2026-119727
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound…
- MEDIUM 6.5CVE-2026-112395public PoC
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the t…
- MEDIUM 6.5CVE-2026-97817
Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-97813
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- MEDIUM 6.5CVE-2026-103011
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), …
- MEDIUM 6.5CVE-2026-91767public PoC
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious serv…
- MEDIUM 6.4CVE-2026-102484
Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.
- MEDIUM 6.4CVE-2026-88085
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
- MEDIUM 6.4CVE-2026-106177
A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability.
- MEDIUM 6.4CVE-2026-105842
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the bu…
- MEDIUM 6.3CVE-2026-65108
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
- MEDIUM 6.3CVE-2026-116258
A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly availab…
- MEDIUM 6.3CVE-2026-116124
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The atta…
- MEDIUM 6.3CVE-2026-107125
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to ver…
- MEDIUM 6.1CVE-2026-112280public PoC
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadca…
- MEDIUM 5.9CVE-2026-77709
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of serv…
- MEDIUM 5.9CVE-2026-122126public PoC
reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can …
- MEDIUM 5.9CVE-2026-103658public PoC
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a reques…
- MEDIUM 5.9CVE-2026-92842public PoC
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(…
- MEDIUM 5.8CVE-2026-110133
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this…
- MEDIUM 5.5CVE-2025-60490public PoC
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- MEDIUM 5.5CVE-2025-60480public PoC
A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- MEDIUM 5.5CVE-2026-85831
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83736
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- MEDIUM 5.5CVE-2026-108978public PoC
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- MEDIUM 5.5CVE-2026-107651
A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially craf…
- MEDIUM 5.5CVE-2026-96423
X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 5.5CVE-2026-96417
RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 5.5CVE-2026-96416
IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 5.5CVE-2026-95388
Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 5.5CVE-2026-88386public PoC
libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This re…
- MEDIUM 5.4CVE-2026-12550
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of ser…
- MEDIUM 5.4CVE-2026-116262
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is po…
- MEDIUM 5.4CVE-2026-11831
IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
mq operator · supplied mq advanced container images
- MEDIUM 5.3CVE-2026-124000public PoC
NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configur…
- MEDIUM 5.3CVE-2026-62365public PoC
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-b…
- MEDIUM 5.3CVE-2026-58953
In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- MEDIUM 5.3CVE-2026-93536
A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code.
- MEDIUM 5.3CVE-2026-109256public PoC
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG…
- MEDIUM 5.3CVE-2026-106574public PoC
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap bu…
- MEDIUM 5.3CVE-2026-106564public PoC
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32…
- MEDIUM 5.3CVE-2026-88370public PoC
libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at in…
- MEDIUM 5.3CVE-2026-18784public PoC
A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requir…
- MEDIUM 5CVE-2026-121517public PoC
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be…
- MEDIUM 4.9CVE-2026-86392
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Heap-based Buffer …
- MEDIUM 4.9CVE-2026-96396
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based b…
- MEDIUM 4.7CVE-2026-95393
CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- MEDIUM 4.4CVE-2026-67456public PoC
NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.
- LOW 3.4CVE-2025-1218public PoC
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffe…
- LOW 3.3CVE-2026-119124public PoC
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corr…
imagemagick
- LOW 3.3CVE-2026-116160public PoC
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites hea…
- LOW 2CVE-2026-73791
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
- UNSCOREDCVE-2026-113364
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted pac…
- UNSCOREDCVE-2026-54914public PoC
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneo…
- UNSCOREDCVE-2026-102212
Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request contai…
- UNSCOREDCVE-2026-47235public PoC
SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `…
- UNSCOREDCVE-2026-116776public PoC
USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DI…
- UNSCOREDCVE-2026-93517
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server con…
- UNSCOREDCVE-2026-57198public PoC
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Ast…
- UNSCOREDCVE-2026-57197public PoC
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a hea…
- UNSCOREDCVE-2026-112710
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrar…
- UNSCOREDCVE-2026-112709
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code …
- UNSCOREDCVE-2026-114112public PoC
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted im…
- UNSCOREDCVE-2026-43855
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
- UNSCOREDCVE-2026-112403public PoC
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is req…
- UNSCOREDCVE-2026-112398public PoC
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode ca…
- UNSCOREDCVE-2026-112393public PoC
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback siz…
- UNSCOREDCVE-2026-111458public PoC
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha25…
- UNSCOREDCVE-2026-77100
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
- UNSCOREDCVE-2026-106547public PoC
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() …
- UNSCOREDCVE-2026-75818
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. A…
- UNSCOREDCVE-2026-83632
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fi…
- UNSCOREDCVE-2026-91135
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fi…
- UNSCOREDCVE-2026-101283
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized a…
- UNSCOREDCVE-2026-97152public PoC
Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.
- UNSCOREDCVE-2026-18457
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from…
- UNSCOREDCVE-2026-88807
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
- UNSCOREDCVE-2026-82717
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis durin…