Common Weakness Enumeration
CWE-122
AllowedHeap-based Buffer Overflow
Abstraction: Variant · Status: Draft
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
6193 vulnerabilities reference this CWE, most recent first.
CVE-2026-112403 (GCVE-0-2026-112403)
Vulnerability from cvelistv5 – Published: 2026-10-19 21:22 – Updated: 2026-10-19 21:22
VLAI
EPSS
VEX
Title
Pillow: Heap buffer overflow in ImagingJpegDecode
Summary
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.
Severity
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/security/… | x_refsource_CONFIRM |
| https://github.com/python-pillow/Pillow/commit/24… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| python-pillow | Pillow |
Affected:
< 13.0.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Pillow",
"vendor": "python-pillow",
"versions": [
{
"status": "affected",
"version": "\u003c 13.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow\u0027s JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg\u0027s actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:22:21.077Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"source": {
"advisory": "GHSA-8g5g-8vmr-9782",
"discovery": "UNKNOWN"
},
"title": "Pillow: Heap buffer overflow in ImagingJpegDecode"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112403",
"datePublished": "2026-10-19T21:22:21.077Z",
"dateReserved": "2026-10-19T16:58:51.959Z",
"dateUpdated": "2026-10-19T21:22:21.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112398 (GCVE-0-2026-112398)
Vulnerability from cvelistv5 – Published: 2026-10-19 21:07 – Updated: 2026-10-19 21:07
VLAI
EPSS
VEX
Title
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Summary
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.
Severity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/security/… | x_refsource_CONFIRM |
| https://github.com/python-pillow/Pillow/commit/24… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| python-pillow | Pillow |
Affected:
< 13.0.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Pillow",
"vendor": "python-pillow",
"versions": [
{
"status": "affected",
"version": "\u003c 13.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow\u0027s FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:07:25.229Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"source": {
"advisory": "GHSA-5x8w-8jj5-q52h",
"discovery": "UNKNOWN"
},
"title": "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112398",
"datePublished": "2026-10-19T21:07:25.229Z",
"dateReserved": "2026-10-19T16:58:51.959Z",
"dateUpdated": "2026-10-19T21:07:25.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112395 (GCVE-0-2026-112395)
Vulnerability from cvelistv5 – Published: 2026-10-19 20:59 – Updated: 2026-10-19 20:59
VLAI
EPSS
VEX
Title
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Summary
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Severity
6.5 (Medium)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/security/… | x_refsource_CONFIRM |
| https://github.com/python-pillow/Pillow/commit/76… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| python-pillow | Pillow |
Affected:
>= 8.2.0, < 13.0.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Pillow",
"vendor": "python-pillow",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.2.0, \u003c 13.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow\u0027s tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow\u0027s stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:59:15.098Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"source": {
"advisory": "GHSA-462x-pgg6-55fp",
"discovery": "UNKNOWN"
},
"title": "Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112395",
"datePublished": "2026-10-19T20:59:15.098Z",
"dateReserved": "2026-10-19T16:58:51.959Z",
"dateUpdated": "2026-10-19T20:59:15.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112393 (GCVE-0-2026-112393)
Vulnerability from cvelistv5 – Published: 2026-10-19 20:46 – Updated: 2026-10-19 21:17
VLAI
EPSS
VEX
Title
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Summary
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:17 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/security/… | x_refsource_CONFIRM |
| https://github.com/python-pillow/Pillow/commit/11… | x_refsource_MISC |
| https://github.com/python-pillow/Pillow/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| python-pillow | Pillow |
Affected:
>= 2.0.0, < 13.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112393",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:17:12.786867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:17:41.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Pillow",
"vendor": "python-pillow",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 13.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:46:40.784Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf"
},
{
"name": "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40"
},
{
"name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"source": {
"advisory": "GHSA-332p-7hrc-92wf",
"discovery": "UNKNOWN"
},
"title": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112393",
"datePublished": "2026-10-19T20:46:40.784Z",
"dateReserved": "2026-10-19T16:58:51.959Z",
"dateUpdated": "2026-10-19T21:17:41.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112280 (GCVE-0-2026-112280)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:34
VLAI
EPSS
VEX
Title
libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body
Summary
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:36 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/aribb24-caption-data-… | third-party-advisory |
| https://github.com/nkoriyama/aribb24/blob/v1.0.3/… | technical-description |
| https://www.vulncheck.com/advisories/libaribb24-a… | third-party-advisory |
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112280",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:36:04.630749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:34:41.023Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/nkoriyama/aribb24",
"defaultStatus": "unaffected",
"product": "aribb24",
"repo": "https://github.com/nkoriyama/aribb24",
"vendor": "nkoriyama",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:25.644Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and-csi-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/parser.c"
},
{
"name": "VulnCheck Advisory: libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libaribb24-aribb24-through-1.0.3-heap-buffer-overflow-via-parse-data-unit-statement-body"
}
],
"title": "libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112280",
"datePublished": "2026-10-19T13:55:25.644Z",
"dateReserved": "2026-10-19T13:25:30.552Z",
"dateUpdated": "2026-10-19T16:34:41.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112021 (GCVE-0-2026-112021)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-19 16:05
VLAI
EPSS
VEX
Title
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
Summary
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:04 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://nullenvk.pl/posts/02-snac2-json | technical-description |
| https://gist.github.com/nullenvk/2bf288e2d34cb3d4… | exploit |
| https://codeberg.org/grunfink/snac2/src/tag/2.92/… | technical-description |
| https://codeberg.org/grunfink/snac2/commit/ec2c5c… | patch |
| https://codeberg.org/grunfink/snac2/releases/tag/2.93 | release-notes |
| https://codeberg.org/grunfink/snac2 | product |
| https://www.vulncheck.com/advisories/snac2-before… | third-party-advisory |
Date Public
2026-07-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112021",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:04:19.806894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:05:15.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snac2",
"repo": "https://codeberg.org/grunfink/snac2",
"vendor": "grunfink",
"versions": [
{
"lessThan": "2.93",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nullenvk"
}
],
"datePublic": "2026-07-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:40.652Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://nullenvk.pl/posts/02-snac2-json"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b"
},
{
"tags": [
"technical-description"
],
"url": "https://codeberg.org/grunfink/snac2/src/tag/2.92/xs_json.h#L283-L285"
},
{
"tags": [
"patch"
],
"url": "https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7"
},
{
"tags": [
"release-notes"
],
"url": "https://codeberg.org/grunfink/snac2/releases/tag/2.93"
},
{
"tags": [
"product"
],
"url": "https://codeberg.org/grunfink/snac2"
},
{
"name": "VulnCheck Advisory: snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer"
}
],
"title": "snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112021",
"datePublished": "2026-10-18T11:38:40.652Z",
"dateReserved": "2026-10-18T01:24:56.329Z",
"dateUpdated": "2026-10-19T16:05:15.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111458 (GCVE-0-2026-111458)
Vulnerability from cvelistv5 – Published: 2026-10-16 05:24 – Updated: 2026-10-16 12:30
VLAI
EPSS
VEX
Title
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
Summary
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-16 05:20 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 12:30 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/adulau/ssldump/commit/8ad55683… | patch |
Impacted products
GCVE extensions
AI-generated
Partially reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-16 05:20 - Model
qwen3.8:27b- Input
-
https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
454d108335b2… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
8ad55683cc01
|
Fix heap overflow in FAN/1 X.509 fingerprint formatting | 454d108335b2… |
Fix summary
The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.
Patch summary
In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.
CVSS rationale
AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.
Weakness rationale
- CWE-122 The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation.
- CWE-787 The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category.
Attack pattern rationale
- CAPEC-109 CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog.
Assumptions to verify
- The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.
- The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).
- The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.
- The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.
- No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.
- The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 11 | medium | 6 |
- 2026-10-16 04:32 UTC Fix developed Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111458",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T12:30:41.664327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:30:53.251Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl/sslxprint.c (fanx_fingerprint)"
],
"product": "ssldump",
"programFiles": [
"ssl/sslxprint.c"
],
"repo": "https://github.com/adulau/ssldump",
"vendor": "adulau",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
},
{
"lang": "en",
"type": "finder",
"value": "https://github.com/TristanInSec"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.\u003c/p\u003e"
}
],
"value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."
}
],
"impacts": [
{
"capecId": "CAPEC-109",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-109 Buffer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T05:26:55.129Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.\u003c/p\u003e"
}
],
"value": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.",
"The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).",
"The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.",
"The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.",
"No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.",
"The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file."
],
"capecRationale": [
{
"capecId": "CAPEC-109",
"rationale": "CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog."
}
],
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
}
],
"cvssRationale": "AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.",
"fixSummary": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.",
"generatedAt": "2026-10-16T05:20:29.596478Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"patchSummary": "In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.",
"patchTruncated": false,
"patches": [
{
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"date": "Fri, 16 Oct 2026 04:32:38 +0000",
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"sourceUrl": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting"
}
],
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"weaknessRationale": [
{
"cweId": "CWE-122",
"rationale": "The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation."
},
{
"cweId": "CWE-787",
"rationale": "The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch"
],
"timestamp": "2026-10-16T04:32:38Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20308"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-111458",
"datePublished": "2026-10-16T05:24:43.178Z",
"dateReserved": "2026-10-16T05:24:32.520Z",
"dateUpdated": "2026-10-16T12:30:53.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111441 (GCVE-0-2026-111441)
Vulnerability from cvelistv5 – Published: 2026-10-19 02:31 – Updated: 2026-10-19 17:42
VLAI
EPSS
VEX
Title
HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
Summary
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:42 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server |
Unaffected:
7.0.0-LTS
|
|
| openGauss-server | openGauss-server |
Affected:
7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3
Affected: 2.1.0 Affected: 3.0.0-3.0.6 Affected: 3.1.0 Affected: 5.0.0-5.0.5 Affected: 6.0.0-6.0.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:42:18.566832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:42:42.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
}
]
},
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3"
},
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "3.0.0-3.0.6"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "5.0.0-5.0.5"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal \u0026gt;= lenUsed\uff0c\u4e5f\u5c06 memcpy_s() \u76ee\u6807\u5927\u5c0f\u5199\u6210 lenUsed \u800c\u975e\u5b9e\u9645\u5206\u914d\u7684 lenTotal\uff0c\u5bfc\u81f4\u5b89\u5168\u62f7\u8d1d\u65e0\u6cd5\u62e6\u622a\u8d8a\u754c\u5199\u3002hll_in()\u3001hll_print()\u3001hll_cardinality() \u7b49 SQL \u5165\u53e3\u4f1a\u8d70\u540c\u4e00\u89e3\u5305\u8def\u5f84\u3002\u56e0\u6b64\uff0c\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u7528\u6237\u53ea\u9700\u6784\u9020 lenTotal \u5c0f\u4e8e lenUsed \u7684\u7578\u5f62 packed HLL\uff08\u4f8b\u5982\u7ecf ::hll \u8fdb\u5165 hll_in()\uff09\uff0c\u5373\u53ef\u89e6\u53d1\u670d\u52a1\u7aef\u5806\u8d8a\u754c\u5199\uff0c\u5b58\u5728\u5185\u5b58\u7834\u574f\u98ce\u9669\u3002\u6b64\u95ee\u9898\u968f packed HLL \u89e3\u5305\u51fd\u6570 HllObjectUnpack() \u8fdb\u5165\u4ee3\u7801\uff0cv2.1.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 2.1.0\u30013.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u5728 HllObjectUnpack() \u4e2d\u8865\u9f50 lenUsed \u0026lt;= lenTotal \u6821\u9a8c\uff0c\u5e76\u5c06 memcpy_s() \u7684\u76ee\u6807\u5927\u5c0f\u6539\u4e3a\u5b9e\u9645\u5206\u914d\u7684 lenTotal\u3002\u4fee\u590d PR \u89c1 https://gitcode.com/opengauss/openGauss-server/pull/9380 \u3002\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal \u003e= lenUsed\uff0c\u4e5f\u5c06 memcpy_s() \u76ee\u6807\u5927\u5c0f\u5199\u6210 lenUsed \u800c\u975e\u5b9e\u9645\u5206\u914d\u7684 lenTotal\uff0c\u5bfc\u81f4\u5b89\u5168\u62f7\u8d1d\u65e0\u6cd5\u62e6\u622a\u8d8a\u754c\u5199\u3002hll_in()\u3001hll_print()\u3001hll_cardinality() \u7b49 SQL \u5165\u53e3\u4f1a\u8d70\u540c\u4e00\u89e3\u5305\u8def\u5f84\u3002\u56e0\u6b64\uff0c\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u7528\u6237\u53ea\u9700\u6784\u9020 lenTotal \u5c0f\u4e8e lenUsed \u7684\u7578\u5f62 packed HLL\uff08\u4f8b\u5982\u7ecf ::hll \u8fdb\u5165 hll_in()\uff09\uff0c\u5373\u53ef\u89e6\u53d1\u670d\u52a1\u7aef\u5806\u8d8a\u754c\u5199\uff0c\u5b58\u5728\u5185\u5b58\u7834\u574f\u98ce\u9669\u3002\u6b64\u95ee\u9898\u968f packed HLL \u89e3\u5305\u51fd\u6570 HllObjectUnpack() \u8fdb\u5165\u4ee3\u7801\uff0cv2.1.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 2.1.0\u30013.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u5728 HllObjectUnpack() \u4e2d\u8865\u9f50 lenUsed \u003c= lenTotal \u6821\u9a8c\uff0c\u5e76\u5c06 memcpy_s() \u7684\u76ee\u6807\u5927\u5c0f\u6539\u4e3a\u5b9e\u9645\u5206\u914d\u7684 lenTotal\u3002\u4fee\u590d PR \u89c1 https://gitcode.com/opengauss/openGauss-server/pull/9380 \u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T02:31:01.069Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/9380"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HLL \u53cd\u5e8f\u5217\u5316 lenTotal/lenUsed \u6821\u9a8c\u7f3a\u5931\u5bfc\u81f4\u5806\u8d8a\u754c\u5199",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111441",
"datePublished": "2026-10-19T02:31:01.069Z",
"dateReserved": "2026-10-16T03:04:58.958Z",
"dateUpdated": "2026-10-19T17:42:42.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111381 (GCVE-0-2026-111381)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 13:56
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser
Summary
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 13:56 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T13:56:34.542741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T13:56:54.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "programmervuln"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:50.516Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-26cc-wjh8-hjw6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser"
}
],
"title": "FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111381",
"datePublished": "2026-10-16T01:17:50.516Z",
"dateReserved": "2026-10-15T21:54:36.054Z",
"dateUpdated": "2026-10-16T13:56:54.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111379 (GCVE-0-2026-111379)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 17:55
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
Summary
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 17:44 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
| https://github.com/programmervuln/freerdp-persist… | exploit |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111379",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T17:44:00.030060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:55:39.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "programmervuln"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:47.354Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-945c-qq5h-jqwp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3"
}
],
"title": "FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111379",
"datePublished": "2026-10-16T01:17:47.354Z",
"dateReserved": "2026-10-15T21:54:36.054Z",
"dateUpdated": "2026-10-16T17:55:39.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Pre-design: Use a language or compiler that performs automatic bounds checking.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Strategy: Libraries or Frameworks
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Mitigation
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.