Base de CVEs

CVE-2026-6350 Crítica · 9.8 CWE-121 16/04/2026

Estouro de buffer baseado em pilha no MailGates/MailAudit da Openfind

MailGates/MailAudit desenvolvido pela Openfind apresenta uma vulnerabilidade de estouro de buffer baseado em pilha, permitindo que atacantes remotos não autenticados controlem o fluxo de execução do programa e executem código arbitrário.

CVE-2026-4682 Alta · 8.7 CWE-121 15/04/2026

Certain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

CVE-2026-30364 Alta · 7.5 CWE-121 15/04/2026

CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1"…

CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.

CVE-2026-32195 Alta · 7.0 CWE-121 14/04/2026

Windows Kernel Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-5713 Média · 5.3 CWE-121 14/04/2026

Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.

CVE-2026-29628 Média · 6.2 CWE-121 13/04/2026

A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit…

A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service (DoS) via supplying a crafted .mtl file.

CVE-2026-35553 Média · 6.7 CWE-121 13/04/2026

Stack-based Buffer Overflow em Dynabook Inc. TOSRFEC.SYS

Bluetooth ACPI Drivers provided by Dynabook Inc. contain a stack-based buffer overflow vulnerability. An attacker may execute arbitrary code by modifying certain registry values.

CVE-2026-4156 Alta · 7.5 CWE-121 10/04/2026

ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability

ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26339.

CVE-2026-5525 Alta · 7.8 CWE-121 10/04/2026

Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).

CVE-2026-5295 Alta · 8.0 CWE-121 09/04/2026

Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OID

A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer (oriOID[MAX_OID_SZ]) via XMEMCPY without first validating that the parsed OID length does not exceed MAX_OID_SZ. A crafted CMS EnvelopedData message with an ORI recipient containing an OID longer than 32 bytes triggers a stack buffer overflow. Exploitation requires the library to be built with --enable-pkcs7 (disabled by default) and the application to have registered an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb().

CVE-2026-39853 Alta · 7.8 CWE-121 09/04/2026

osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.

CVE-2025-50671 Alta · 7.5 CWE-121 08/04/2026