Common Weakness Enumeration
CWE-787
Allowed-with-ReviewOut-of-bounds Write
Abstraction: Base · Status: Draft
The product writes data past the end, or before the beginning, of the intended buffer.
16426 vulnerabilities reference this CWE, most recent first.
CVE-2026-111137 (GCVE-0-2026-111137)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-16 17:10
VLAI
EPSS
VEX
Title
libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL
Summary
libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:28 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libsmi-smivalueasstr… | technical-descriptionexploit |
| https://github.com/amartin755/libsmi/blob/c583072… | technical-description |
| https://github.com/amartin755/libsmi | product |
| https://www.vulncheck.com/advisories/libsmi-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| amartin755 | libsmi |
Affected:
0 , ≤ 0.5.0
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111137",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:28:04.914973Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:10:45.000Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/amartin755/libsmi",
"defaultStatus": "unaffected",
"product": "libsmi",
"repo": "https://github.com/amartin755/libsmi",
"vendor": "amartin755",
"versions": [
{
"lessThanOrEqual": "0.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:30.581Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libsmi-smivalueasstring-octetstring-defval-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/amartin755/libsmi/blob/c58307210fe995ec419db976eb234aebc71a9216/lib/smi.c#L479-L566"
},
{
"tags": [
"product"
],
"url": "https://github.com/amartin755/libsmi"
},
{
"name": "VulnCheck Advisory: libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libsmi-through-0.5.0-out-of-bounds-write-via-smivalueasstring-octet-string-defval"
}
],
"title": "libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111137",
"datePublished": "2026-10-15T18:57:30.581Z",
"dateReserved": "2026-10-15T17:03:55.430Z",
"dateUpdated": "2026-10-16T17:10:45.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111136 (GCVE-0-2026-111136)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:48
VLAI
EPSS
VEX
Title
libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid
Summary
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:47 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libinstpatch-sf2-gen… | technical-description |
| https://github.com/swami/libinstpatch/blob/4ff193… | technical-description |
| https://github.com/swami/libinstpatch/blob/4ff193… | technical-description |
| https://github.com/swami/libinstpatch/blob/4ff193… | technical-description |
| https://github.com/swami/libinstpatch | product |
| https://www.vulncheck.com/advisories/libinstpatch… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| swami | libinstpatch |
Affected:
0 , ≤ 1.1.7
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111136",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:47:44.671476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:48:10.296Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/swami/libinstpatch",
"product": "libinstpatch",
"repo": "https://github.com/swami/libinstpatch",
"vendor": "swami",
"versions": [
{
"lessThanOrEqual": "1.1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:29.888Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/libinstpatch-sf2-generator-id-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Gen.c#L189-L205"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L1355-L1370"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/swami/libinstpatch/blob/4ff1939ccc24de204d41b3ab734fc1aece919184/libinstpatch/IpatchSF2Reader.c#L954-L969"
},
{
"tags": [
"product"
],
"url": "https://github.com/swami/libinstpatch"
},
{
"name": "VulnCheck Advisory: libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libinstpatch-through-1.1.7-heap-out-of-bounds-write-via-ipatch-sf2-gen-is-valid"
}
],
"title": "libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111136",
"datePublished": "2026-10-15T18:57:29.888Z",
"dateReserved": "2026-10-15T17:03:55.076Z",
"dateUpdated": "2026-10-15T19:48:10.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111123 (GCVE-0-2026-111123)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:46
VLAI
EPSS
VEX
Title
FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination
Summary
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:46 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/fluidsynth-sf2-modul… | technical-description |
| https://github.com/FluidSynth/fluidsynth/blob/71e… | technical-description |
| https://github.com/FluidSynth/fluidsynth/blob/71e… | technical-description |
| https://github.com/FluidSynth/fluidsynth/blob/71e… | technical-description |
| https://github.com/FluidSynth/fluidsynth | product |
| https://www.vulncheck.com/advisories/fluidsynth-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FluidSynth | fluidsynth |
Affected:
0 , ≤ 2.6.1
(semver)
cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111123",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:46:04.553463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:46:31.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/fluidsynth-sf2-modulator-dest-generator-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/FluidSynth/fluidsynth",
"product": "fluidsynth",
"repo": "https://github.com/FluidSynth/fluidsynth",
"vendor": "FluidSynth",
"versions": [
{
"lessThanOrEqual": "2.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:20.663Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/fluidsynth-sf2-modulator-dest-generator-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L615-L623"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/synth/fluid_voice.c#L1184-L1229"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FluidSynth/fluidsynth/blob/71e85b2ca6bf48641ba7e2261d8f2640ae473773/src/sfloader/fluid_defsfont.c#L1609-L1611"
},
{
"tags": [
"product"
],
"url": "https://github.com/FluidSynth/fluidsynth"
},
{
"name": "VulnCheck Advisory: FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fluidsynth-through-2.6.1-out-of-bounds-write-via-soundfont-modulator-destination"
}
],
"title": "FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111123",
"datePublished": "2026-10-15T18:57:20.663Z",
"dateReserved": "2026-10-15T17:03:42.957Z",
"dateUpdated": "2026-10-15T19:46:31.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110875 (GCVE-0-2026-110875)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 18:57
VLAI
EPSS
VEX
Title
AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp
Summary
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
Severity
6.1 (Medium)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/adplug-ksm-note-loop… | technical-description |
| https://github.com/adplug/adplug/blob/e491e382479… | technical-description |
| https://github.com/adplug/adplug/issues/292 | issue-tracking |
| https://github.com/adplug/adplug/pull/295 | issue-trackingpatch |
| https://github.com/adplug/adplug | product |
| https://www.vulncheck.com/advisories/adplug-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-02 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/adplug/adplug",
"product": "adplug",
"repo": "https://github.com/adplug/adplug",
"vendor": "adplug",
"versions": [
{
"lessThanOrEqual": "2.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adplug_project:adplug:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "TristanInSec"
},
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:17.940Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/adplug-ksm-note-loop-databuf-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/adplug/adplug/blob/e491e382479ed2246f124c96c70d94561dce59b9/src/ksm.cpp#L99-L229"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/adplug/adplug/issues/292"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/adplug/adplug/pull/295"
},
{
"tags": [
"product"
],
"url": "https://github.com/adplug/adplug"
},
{
"name": "VulnCheck Advisory: AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/adplug-through-2.4-heap-buffer-overflow-via-cksmplayer-update-in-ksm-cpp"
}
],
"title": "AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110875",
"datePublished": "2026-10-15T18:57:17.940Z",
"dateReserved": "2026-10-14T22:21:21.397Z",
"dateUpdated": "2026-10-15T18:57:17.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110839 (GCVE-0-2026-110839)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 15:33
VLAI
EPSS
VEX
Title
FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data
Summary
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:32 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-3.3.… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110839",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:32:10.467016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:33:06.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "3.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"versionStartIncluding": "3.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "finder",
"value": "skigeek16"
},
{
"lang": "en",
"type": "finder",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:14.540Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-99p4-8j24-wvj4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4"
},
{
"name": "VulnCheck Advisory: FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data"
}
],
"title": "FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110839",
"datePublished": "2026-10-14T22:52:14.540Z",
"dateReserved": "2026-10-14T22:12:22.054Z",
"dateUpdated": "2026-10-15T15:33:06.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110734 (GCVE-0-2026-110734)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:36 – Updated: 2026-10-15 16:08 Disputed
VLAI
EPSS
VEX
Summary
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:42 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| godotengine | Godot Engine |
Affected:
3.0.0 , ≤ 4.7.2
(semver)
cpe:2.3:a:godotengine:godot_engine:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:42:31.644549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:42:46.545Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-15T16:08:05.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/15/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"HDR image importer"
],
"product": "Godot Engine",
"programFiles": [
"modules/hdr/image_loader_hdr.cpp"
],
"programRoutines": [
{
"name": "ImageLoaderHDR::load_image"
}
],
"repo": "https://github.com/godotengine/godot",
"vendor": "godotengine",
"versions": [
{
"lessThanOrEqual": "4.7.2",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:godotengine:godot_engine:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.7.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction\u0027s repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier\u0027s position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:36:08.839Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/godotengine/godot/issues/123608"
},
{
"url": "https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers"
}
],
"tags": [
"disputed"
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-110734",
"datePublished": "2026-10-14T15:36:08.839Z",
"dateReserved": "2026-10-14T15:36:08.439Z",
"dateUpdated": "2026-10-15T16:08:05.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110715 (GCVE-0-2026-110715)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-15 19:13
VLAI
EPSS
VEX
Title
MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
Summary
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:12 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob | technical-descriptionexploit |
| https://codeberg.org/ccxvii/mujs/src/commit/307f1… | technical-description |
| https://codeberg.org/ccxvii/mujs/commit/32064e10c… | patch |
| https://mujs.com/downloads/ | release-notes |
| https://codeberg.org/ccxvii/mujs | product |
| https://www.vulncheck.com/advisories/mujs-1.3.6-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Artifex Software | MuJS |
Affected:
1.3.6 , < 1.3.9
(semver)
cpe:2.3:a:artifex:mujs:*:*:*:*:*:*:*:* |
Date Public
2026-03-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110715",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:12:30.683487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:13:59.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://codeberg.org/ccxvii/mujs",
"defaultStatus": "unaffected",
"product": "MuJS",
"repo": "https://codeberg.org/ccxvii/mujs",
"vendor": "Artifex Software",
"versions": [
{
"lessThan": "1.3.9",
"status": "affected",
"version": "1.3.6",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:artifex:mujs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.9",
"versionStartIncluding": "1.3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-03-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array\u0027s length. Attackers can supply JavaScript that enlarges a dense array\u0027s length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:01:29.904Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob"
},
{
"tags": [
"technical-description"
],
"url": "https://codeberg.org/ccxvii/mujs/src/commit/307f18c4216420f2f56e22d8e7040baa39a6304a/jsarray.c#L245"
},
{
"tags": [
"patch"
],
"url": "https://codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396"
},
{
"tags": [
"release-notes"
],
"url": "https://mujs.com/downloads/"
},
{
"tags": [
"product"
],
"url": "https://codeberg.org/ccxvii/mujs"
},
{
"name": "VulnCheck Advisory: MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mujs-1.3.6-before-1.3.9-heap-out-of-bounds-read-write-via-array-prototype-sort"
}
],
"title": "MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110715",
"datePublished": "2026-10-14T15:01:29.904Z",
"dateReserved": "2026-10-14T14:39:52.987Z",
"dateUpdated": "2026-10-15T19:13:59.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110698 (GCVE-0-2026-110698)
Vulnerability from cvelistv5 – Published: 2026-10-14 21:45 – Updated: 2026-10-14 21:45 X_Open Source
VLAI
EPSS
VEX
Title
Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write
Summary
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/419892 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/419892/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-110698 | third-party-advisory |
| https://vuldb.com/submit/1004713 | third-party-advisory |
| https://github.com/praat/praat.github.io/issues/3348 | exploitissue-tracking |
| https://github.com/PaulBoersma/praat/commit/a910d… | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:praat:praat:*:*:*:*:*:*:*:*"
],
"modules": [
"Model Loader"
],
"product": "Praat",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.0.02"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: \"We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2).\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T21:45:09.762Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-419892 | Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/419892"
},
{
"name": "VDB-419892 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/419892/cti"
},
{
"name": "CVE-2026-110698 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-110698"
},
{
"name": "Submit #1004713 | Praat \u00a0Praat commit b753a09ba0f4c2385735f08dacd2086088094d69 Out-of-bounds Write",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004713"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/praat/praat.github.io/issues/3348"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PaulBoersma/praat/commit/a910d21a2705ef4cd16d91f29cdc8da1ab1a7221"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-14T16:18:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-110698",
"datePublished": "2026-10-14T21:45:09.762Z",
"dateReserved": "2026-10-14T14:13:07.703Z",
"dateUpdated": "2026-10-14T21:45:09.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110654 (GCVE-0-2026-110654)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:01 – Updated: 2026-10-14 15:01
VLAI
EPSS
VEX
Title
libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
Summary
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.
Severity
6.1 (Medium)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-m… | technical-descriptionexploit |
| https://github.com/zapping-vbi/zvbi/blob/d3a5ee9f… | technical-description |
| https://github.com/zapping-vbi/zvbi | product |
| https://www.vulncheck.com/advisories/libzvbi-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zapping-vbi | libzvbi |
Affected:
0 , ≤ 0.2.45
(semver)
|
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/zapping-vbi/zvbi",
"defaultStatus": "unaffected",
"product": "libzvbi",
"repo": "https://github.com/zapping-vbi/zvbi",
"vendor": "zapping-vbi",
"versions": [
{
"lessThanOrEqual": "0.2.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:01:21.898Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zapping-vbi/zvbi/blob/d3a5ee9f2b047bf16cd1ee5ccf6ec05ee75409d0/src/packet.c#L447"
},
{
"tags": [
"product"
],
"url": "https://github.com/zapping-vbi/zvbi"
},
{
"name": "VulnCheck Advisory: libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libzvbi-through-0.2.45-out-of-bounds-write-via-teletext-drcs-convert-drcs"
}
],
"title": "libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110654",
"datePublished": "2026-10-14T15:01:21.898Z",
"dateReserved": "2026-10-14T13:08:38.678Z",
"dateUpdated": "2026-10-14T15:01:21.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110601 (GCVE-0-2026-110601)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
VLAI
EPSS
VEX
Title
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
Summary
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
Severity
6.3 (Medium)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/saitoha/libsixel/issues/220 | issue-tracking |
| https://github.com/saitoha/libsixel/commit/bdbab0… | patch |
| https://github.com/saitoha/libsixel/releases/tag/… | release-notes |
| https://github.com/saitoha/libsixel/blob/v1.8.7/s… | technical-description |
| https://github.com/libsixel/libsixel/blob/v1.10.5… | technical-description |
| https://hackmd.io/@haind-pwn/libsixel-gif-transpa… | third-party-advisory |
| https://www.vulncheck.com/advisories/libsixel-bef… | third-party-advisory |
Impacted products
Date Public
2026-03-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/saitoha/libsixel",
"product": "libsixel",
"repo": "https://github.com/saitoha/libsixel",
"vendor": "saitoha",
"versions": [
{
"lessThan": "1.8.7-r1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.10.5",
"status": "affected",
"version": "1.9.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.7-r1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.10.5",
"versionStartIncluding": "1.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ShangzhiXu"
},
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-03-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:43.022Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/saitoha/libsixel/issues/220"
},
{
"tags": [
"patch"
],
"url": "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047"
},
{
"name": "libsixel v1.8.7-r1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/saitoha/libsixel/blob/v1.8.7/src/fromgif.c#L182-L248"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsixel/libsixel/blob/v1.10.5/src/fromgif.c#L219-L240"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind-pwn/libsixel-gif-transparent-index-oob-write"
},
{
"name": "VulnCheck Advisory: libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libsixel-before-1.8.7-r1-and-1.9.0-through-1.10.5-heap-out-of-bounds-write-via-gif"
}
],
"title": "libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110601",
"datePublished": "2026-10-14T14:16:43.022Z",
"dateReserved": "2026-10-14T13:07:20.557Z",
"dateUpdated": "2026-10-14T14:16:43.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
- Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
- Consider adhering to the following rules when allocating and managing an application's memory:
- Double check that the buffer is as large as specified.
- When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
- Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
- If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation
Strategy: Environment Hardening
- Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
- For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
No CAPEC attack patterns related to this CWE.