Base de CVEs

CVE-2026-18279 Alta · 8.8 CWE-120 20/08/2026

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SETUP RTSP packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29042.

CVE-2026-20302 Média · 6.1 CWE-120 19/08/2026

Cisco RoomOS Stack Overflow Vulnerability

A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.

CVE-2026-14970 Alta · 7.5 CWE-120 19/08/2026

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow.

CVE-2026-19489 Alta · 8.8 CWE-120 19/08/2026

Classic Buffer Overflow em NetScaler ADC

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

CVE-2026-24184 Alta · 8.8 CWE-120 18/08/2026

Classic Buffer Overflow em NVIDIA Cumulus Linux

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.

CVE-2026-70415 Alta · 8.1 CWE-120 18/08/2026

Classic Buffer Overflow em Dell PowerStore 500T

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service.

CVE-2026-75093 Média · 4.3 CWE-120 17/08/2026

sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue.

CVE-2026-39255 Crítica · 9.8 CWE-120 17/08/2026

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote…

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dup_wcs components

CVE-2026-39254 Crítica · 9.8 CWE-120 17/08/2026

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote…

Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevice::DeviceGetDescriptionString components

CVE-2026-72066 Alta · 7.8 CWE-120 15/08/2026

cpu: hotplug: Bound hotplug states sysfs output

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states_show() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGE_SIZE buffer. Use sysfs_emit_at() so output is bounded.

CVE-2026-17220 Alta · 8.2 CWE-120 13/08/2026

IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

CVE-2026-68452 Alta · 7.8 CWE-120 13/08/2026

s390/zcrypt: Validate length for CCA AES cipher key requests

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

CVE-2026-68451 Alta · 7.8 CWE-120 13/08/2026

s390/zcrypt: Validate length for CCA ECC private key requests

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

CVE-2026-19002 Alta · 8.1 CWE-120 12/08/2026

Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

CVE-2026-70465 Alta · 8.1 CWE-120 12/08/2026

Classic Buffer Overflow em Fortinet FortiClientWindows

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.

CVE-2025-41769 Crítica · 9.8 CWE-120 12/08/2026

Unauthenticated Buffer Overflow in PROFINET Service

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

CVE-2026-15565 Alta · 7.5 CWE-120 11/08/2026

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

CVE-2026-71958 Crítica · 9.8 CWE-120 08/08/2026

D-Link DWR-M961 Buffer Overflow via quicksetup.cgi

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

CVE-2026-71957 Crítica · 9.8 CWE-120 08/08/2026

D-Link DWR-M961 Buffer Overflow via app.cgi

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

CVE-2026-20348 Alta · 7.5 CWE-120 07/08/2026

ClamAV XAR File Format Processing Memory Corruption Vulnerability

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVE-2026-20337 Alta · 7.5 CWE-120 07/08/2026

ClamAV ZIP File Format Processing Memory Corruption Vulnerability

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVE-2026-67871 Alta · 7.5 CWE-120 05/08/2026

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause…

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_internal.c, and toolkit_test_server

CVE-2026-67869 Alta · 7.5 CWE-120 05/08/2026

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a…

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata

CVE-2026-18103 Média · 4.9 CWE-120 04/08/2026

Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

CVE-2026-45537 Crítica · 9.1 CWE-120 04/08/2026

OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.