Base de CVEs

CVE-2019-25705 Alta · 7.8 CWE-787 12/04/2026

Echo Mirage 3.1 Stack Buffer Overflow via Rules Action Field

Echo Mirage 3.1 contains a stack buffer overflow vulnerability that allows local attackers to crash the application or execute arbitrary code by supplying an oversized string in the Rules action field. Attackers can create a malicious text file with a crafted payload exceeding buffer boundaries and paste it into the action field through the Rules dialog to trigger the overflow and overwrite the return address.

CVE-2019-25701 Alta · 7.8 CWE-787 12/04/2026

Easy Video to iPod Converter 1.6.20 Local Buffer Overflow SEH

Easy Video to iPod Converter 1.6.20 contains a local buffer overflow vulnerability in the user registration field that allows local attackers to overwrite the structured exception handler. Attackers can input a crafted payload exceeding 996 bytes in the username field to trigger SEH overwrite and execute arbitrary code with user privileges.

CVE-2019-25695 Alta · 8.4 CWE-787 12/04/2026

R 3.4.4 Local Buffer Overflow Windows XP SP3

R 3.4.4 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by injecting malicious input into the GUI Preferences language field. Attackers can craft a payload with a 292-byte offset and JMP ESP instruction to execute commands like calc.exe when the payload is pasted into the Language for menus and messages field.

CVE-2019-25691 Alta · 8.4 CWE-787 12/04/2026

Faleemi Desktop Software 1.8 Local Buffer Overflow SEH DEP Bypass

Faleemi Desktop Software 1.8 contains a local buffer overflow vulnerability in the System Setup dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can inject a crafted payload into the Save Path for Snapshot and Record file field to trigger a buffer overflow and execute arbitrary code via ROP chain gadgets.

CVE-2019-25689 Alta · 7.8 CWE-787 12/04/2026

HTML5 Video Player 1.2.5 Local Buffer Overflow Non-SEH

HTML5 Video Player 1.2.5 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized key code string. Attackers can craft a malicious payload exceeding 997 bytes and paste it into the KEY CODE field in the Help Register dialog to trigger code execution and spawn a calculator process.

CVE-2026-5495 Alta · 7.8 CWE-787 10/04/2026

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDSPRJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25720.

CVE-2026-5494 Alta · 7.8 CWE-787 10/04/2026

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDSPRJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25719.

CVE-2026-5493 Alta · 7.8 CWE-787 10/04/2026

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDSPRJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25718.

CVE-2026-6069 Alta · 7.5 CWE-787 10/04/2026

CVE-2026-6069

NASM’s disasm() function contains a stack based buffer overflow when formatting disassembly output, allowing an attacker triggered out-of-bounds write when `slen` exceeds the buffer capacity.

CVE-2026-6067 Média · 5.5 CWE-787 10/04/2026

CVE-2026-6067

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execution.

CVE-2026-5503 Crítica · 9.1 CWE-787 09/04/2026

Escrita fora de limites na wolfSSL em TLSX_EchChangeSNI (tratamento de SNI com ECH)

Em TLSX_EchChangeSNI, o ramo ctx->extensions definia extensions incondicionalmente mesmo quando TLSX_Find retornava NULL. Isso fez com que TLSX_UseSNI anexasse o publicName controlado pelo atacante ao WOLFSSL_CTX compartilhado quando nenhum SNI interno estava configurado. TLSX_EchRestoreSNI entao falhava em limpar isso porque a remocao estava condicionada a serverNameX != NULL. O ClientHello interno foi dimensionado antes da poluicao, mas escrito depois dela, fazendo com que TLSX_SNI_Write executasse memcpy de 255 bytes alem do limite da alocacao.

CVE-2026-35195 Média · 5.4 CWE-787 09/04/2026

Wasmtime has an out-of-bounds write or crash when transcoding component model strings

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

CVE-2026-5444 Alta · 7.1 CWE-787 09/04/2026

Heap Buffer Overflow in PAM Image Buffer Allocation

A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned arithmetic. Specially chosen values can cause an integer overflow during buffer size calculation, resulting in the allocation of a small buffer followed by a much larger write operation during pixel processing.

CVE-2026-5443 Crítica · 9.8 CWE-787 09/04/2026

Estouro de buffer no heap no decodificador de imagens DICOM do Orthanc (PALETTE COLOR)

Existe uma vulnerabilidade de estouro de buffer no heap durante a decodificação de imagens DICOM do tipo PALETTE COLOR. A validação do tamanho dos pixels usa multiplicação de 32 bits para os cálculos de largura e altura. Se esses valores transbordarem, a verificação de validação é incorretamente aprovada, permitindo que o decodificador leia e escreva na memória além dos buffers alocados.

CVE-2026-5442 Crítica · 9.8 CWE-787 09/04/2026

Estouro de buffer no heap no decodificador de imagens DICOM do Orthanc via dimensões VR UL

Existe uma vulnerabilidade de estouro de buffer no heap no decodificador de imagens DICOM. Os campos de dimensão são codificados usando Value Representation (VR) Unsigned Long (UL), em vez do esperado VR Unsigned Short (US), o que permite que dimensões extremamente grandes sejam processadas. Isso causa um estouro de inteiro durante o cálculo do tamanho do frame e resulta em acesso à memória fora dos limites durante a decodificação da imagem.

CVE-2026-30814 Alta · 8.0 CWE-787 08/04/2026

Buffer Overflow Vulnerability in TP-Link AX53

A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute arbitrary code via a specially crafted configuration file. Successful exploitation may cause a crash and could allow arbitrary code execution, enabling modification of device state, exposure of sensitive data, or further compromise of device integrity. This issue affects AX53 v1.0: before 1.7.1 Build 20260213.

CVE-2025-52221 Crítica · 9.8 CWE-787 08/04/2026

Out-of-bounds Write em Tenda Ac6 Firmware

Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.

CVE-2026-5726 Alta · 8.4 CWE-787 08/04/2026

ASDA-Soft Stack-based Buffer Overflow Vulnerability

CVE-2026-31789 Crítica · 9.8 CWE-787 07/04/2026

Heap Buffer Overflow in Hexadecimal Conversion

Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVE-2026-32862 Alta · 7.8 CWE-787 07/04/2026

Out-of-Bounds Write in ResFileFactory::InitResourceMgr()

There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

CVE-2026-32861 Alta · 7.8 CWE-787 07/04/2026

Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvclass file

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVCLASS file in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvclass file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

CVE-2026-32860 Alta · 7.8 CWE-787 07/04/2026

Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib file

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvlib file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

CVE-2026-33816 Crítica · 9.8 CWE-787 07/04/2026

Escrita fora dos limites em jackc pgx (CVE-2026-33816)

Vulnerabilidade de segurança de memória em github.com/jackc/pgx/v5.

CVE-2026-33815 Crítica · 9.8 CWE-787 07/04/2026

Escrita fora dos limites em github.com/jackc/pgx (CVE-2026-33815)

Vulnerabilidade de segurança de memória em github.com/jackc/pgx/v5.

CVE-2025-62818 Crítica · 9.8 CWE-787 07/04/2026

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980,...

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. An out-of-bounds write occurs due to a mismatch between the TP-UDHI and UDL values when processing an SMS TP-UD packet.