Base de CVEs

CVE-2025-59482 Alta · 8.0 CWE-122 03/02/2026

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a field whose length exceeds the maximum expected value.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVE-2025-58455 Alta · 8.0 CWE-122 03/02/2026

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet whose length exceeds the maximum expected value.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVE-2025-58077 Alta · 8.0 CWE-122 03/02/2026

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted set of network packets containing an excessive number of host entries This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVE-2026-23567 Média · 6.5 CWE-122 29/01/2026

Integer underflow in Content Distribution Service UDP handler

An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network attacker to trigger a heap-based buffer overflow and cause a denial-of-service (service crash) via specially crafted UDP packets.

CVE-2026-24852 Alta · 8.1 CWE-122 27/01/2026

iccDEV has a heap-buffer-overflow in icXmlParseTextString()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

CVE-2026-24829 Média · 6.5 CWE-122 27/01/2026

Out-of-bounds write in is-Engine

Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4.

CVE-2026-24822 Crítica · 10.0 CWE-122 27/01/2026

Estouro de buffer baseado em heap no ttttupup wxhelper (src/mongoose)

Vulnerabilidade de escrita fora dos limites e estouro de buffer baseado em heap em ttttupup wxhelper (módulos src). Esta vulnerabilidade está associada aos arquivos de programa mongoose.C. Esta questão afeta wxhelper: até 3.9.10.19-v1.

CVE-2026-1283 Alta · 7.8 CWE-122 26/01/2026

Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026

A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.

CVE-2025-15059 Alta · 7.8 CWE-122 23/01/2026

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28232.

CVE-2026-23876 Crítica · 9.8 CWE-122 19/01/2026

Estouro de buffer no heap no parser XBM do ImageMagick (ReadXBMImage)

O ImageMagick é um software gratuito e de código aberto usado para editar e manipular imagens digitais. Nas versões anteriores a 7.1.2-13 e 6.9.13-38, uma vulnerabilidade de estouro de buffer no heap no decodificador de imagens XBM (ReadXBMImage) permite que um atacante grave dados controlados além do buffer de heap alocado ao processar um arquivo de imagem maliciosamente elaborado. Qualquer operação que leia ou identifique uma imagem pode acionar o estouro, tornando-o explorável por meio de pipelines comuns de upload e processamento de imagens. As versões 7.1.2-13 e 6.9.13-38 corrigem o problema.

CVE-2026-23732 Alta · 7.5 CWE-122 19/01/2026

FreeRDP has heap-buffer-overflow in Glyph_Alloc

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.

CVE-2026-23534 Crítica · 9.8 CWE-122 19/01/2026

FreeRDP has heap-buffer-overflow in clear_decompress_bands_data

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

CVE-2026-23533 Crítica · 9.8 CWE-122 19/01/2026

FreeRDP: estouro de buffer na heap na decodificação de dados residuais ClearCodec

O FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.21.0, ocorre um estouro de buffer na heap do lado cliente no caminho de decodificação ClearCodec do RDPGFX, quando dados residuais maliciosamente construídos causam escritas fora dos limites durante a saída de cores. Um servidor malicioso pode acionar um estouro de buffer na heap do lado cliente, causando travamento (DoS) e possível corrupção de heap, com risco de execução de código dependendo do comportamento do alocador e do layout da heap. A versão 3.21.0 contém uma correção para o problema.

CVE-2026-23532 Crítica · 9.8 CWE-122 19/01/2026

FreeRDP: estouro de buffer baseado em heap em gdi_SurfaceToSurface

FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.21.0, ocorre um estouro de buffer no heap do lado do cliente no caminho `gdi_SurfaceToSurface` do cliente FreeRDP, devido a uma incompatibilidade entre o recorte do retângulo de destino e o tamanho real da cópia. Um servidor malicioso pode provocar esse estouro no cliente, causando travamento (DoS) e possível corrupção de heap, com risco de execução de código dependendo do comportamento do alocador e do layout da heap ao redor. A versão 3.21.0 contém uma correção para o problema.

CVE-2026-23531 Crítica · 9.8 CWE-122 19/01/2026

FreeRDP: estouro de buffer no heap em clear_decompress (ClearCodec)

O FreeRDP é uma implementação livre do Protocolo de Área de Trabalho Remota (Remote Desktop Protocol). Antes da versão 3.21.0, no ClearCodec, quando glyphData está presente, clear_decompress chama freerdp_image_copy_no_overlap sem validar o retângulo de destino, permitindo leitura e escrita fora dos limites por meio de atualizações de superfície RDPGFX forjadas. Um servidor malicioso pode provocar um estouro de buffer no heap do lado do cliente, causando falha (DoS) e possível corrupção de heap, com risco de execução de código dependendo do comportamento do alocador e do layout do heap. A versão 3.21.0 contém um patch para o problema.

CVE-2026-23530 Crítica · 9.8 CWE-122 19/01/2026

Estouro de buffer no heap na descompressão planar RLE do FreeRDP

FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.21.0, a função freerdp_bitmap_decompress_planar não valida nSrcWidth/nSrcHeight contra planar->maxWidth/maxHeight antes da decodificação RLE. Um servidor malicioso pode acionar um estouro de buffer no heap do lado do cliente, causando travamento (DoS) e possível corrupção de heap com risco de execução de código, dependendo do comportamento do alocador e do layout do heap ao redor. A versão 3.21.0 contém um patch para o problema.

CVE-2025-70303 Média · 5.5 CWE-122 15/01/2026

Heap-based Buffer Overflow em Gpac

A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

CVE-2025-70302 Média · 5.5 CWE-122 15/01/2026

Heap-based Buffer Overflow em Gpac

A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-70299 Média · 6.5 CWE-122 15/01/2026

Heap-based Buffer Overflow em Gpac

A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.

CVE-2025-70310 Média · 5.5 CWE-122 15/01/2026

Heap-based Buffer Overflow em Gpac

A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file.

CVE-2026-22854 Crítica · 9.8 CWE-122 14/01/2026

FreeRDP: estouro de buffer baseado em heap no caminho de leitura de drive

FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.20.1, ocorre um heap-buffer-overflow na leitura de drive quando um comprimento de leitura controlado pelo servidor é usado para ler dados de arquivo para um buffer de fluxo de saída IRP sem um limite superior rígido, permitindo que uma leitura excessiva sobrescreva a memória heap. Esta vulnerabilidade está corrigida na versão 3.20.1.

CVE-2026-20957 Alta · 7.8 CWE-122 13/01/2026

Microsoft Excel Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-20922 Alta · 7.8 CWE-122 13/01/2026

Windows NTFS Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

CVE-2026-20876 Média · 6.7 CWE-122 13/01/2026

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

CVE-2026-20868 Alta · 8.8 CWE-122 13/01/2026

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.