Base de CVEs

CVE-2026-0793 Crítica · 9.8 CWE-787 23/01/2026

ALGO 8180 IP Audio Alerter InformaCast: estouro de buffer em heap com execução remota de código

Vulnerabilidade de Execução Remota de Código por Estouro de Buffer Baseado em Heap no ALGO 8180 IP Audio Alerter InformaCast. Esta vulnerabilidade permite que atacantes remotos executem código arbitrário em instalações afetadas dos dispositivos ALGO 8180 IP Audio Alerter. Não é necessária autenticação para explorar esta vulnerabilidade. O problema específico existe na funcionalidade InformaCast. O problema resulta da falta de validação adequada do tamanho de dados fornecidos pelo usuário antes de copiá-los para um buffer baseado em heap. Um atacante pode aproveitar esta vulnerabilidade para executar código no contexto do dispositivo. Foi ZDI-CAN-28302.

CVE-2026-0792 Crítica · 9.8 CWE-787 23/01/2026

Estouro de buffer na pilha no ALGO 8180 IP Audio Alerter via cabeçalho Alert-Info de SIP INVITE

ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. Esta vulnerabilidade permite que atacantes remotos executem código arbitrário em instalações afetadas dos dispositivos ALGO 8180 IP Audio Alerter. Não é necessária autenticação para explorar esta vulnerabilidade. A falha específica existe no tratamento do cabeçalho Alert-Info de requisições SIP INVITE. O problema decorre da falta de validação adequada do tamanho dos dados fornecidos pelo usuário antes de copiá-los para um buffer de tamanho fixo na pilha. Um atacante pode aproveitar esta vulnerabilidade para executar código no contexto do dispositivo. Foi ZDI-CAN-28301.

CVE-2026-0791 Crítica · 9.8 CWE-787 23/01/2026

ALGO 8180 IP Audio Alerter: estouro de buffer na pilha pelo cabeçalho Replaces do SIP INVITE (RCE)

ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. Esta vulnerabilidade permite que atacantes remotos executem código arbitrário em instalações afetadas dos dispositivos ALGO 8180 IP Audio Alerter. A autenticação não é necessária para explorar esta vulnerabilidade. A falha específica existe no tratamento do cabeçalho Replaces de requisições SIP INVITE. O problema resulta da falta de validação adequada do tamanho de dados fornecidos pelo usuário antes de copiá-los para um buffer de tamanho fixo baseado na pilha. Um atacante pode aproveitar esta vulnerabilidade para executar código no contexto do dispositivo. Foi ZDI-CAN-28300.

CVE-2025-15537 Média · 5.5 CWE-787 18/01/2026

Mapnik dbfile.cpp string_value heap-based overflow

A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2025-15536 Média · 5.5 CWE-787 18/01/2026

BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

CVE-2025-14237 Crítica · 9.8 CWE-787 15/01/2026

Out-of-bounds Write em Canon Inc. Mf455dw Firmware

Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVE-2025-14236 Crítica · 9.8 CWE-787 15/01/2026

Out-of-bounds Write em Canon Inc. Mf455dw Firmware

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVE-2025-14235 Crítica · 9.8 CWE-787 15/01/2026

Out-of-bounds Write em Canon Inc. Mf656cdw Firmware

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVE-2025-14234 Crítica · 9.8 CWE-787 15/01/2026

Out-of-bounds Write em Canon Inc. Mf455dw Firmware

Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVE-2025-14232 Crítica · 9.8 CWE-787 15/01/2026

Out-of-bounds Write em Canon Inc. Mf455dw Firmware

Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVE-2025-14231 Crítica · 9.8 CWE-787 15/01/2026

Out-of-bounds Write em Canon Inc. Lbp1238 Ii Firmware

Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

CVE-2021-47789 Alta · 7.5 CWE-787 15/01/2026

Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial of Service (PoC)

Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. Attackers can exploit the driver by sending a 2000-byte buffer through DeviceIoControl to trigger a kernel-level system crash.

CVE-2021-47786 Alta · 7.5 CWE-787 15/01/2026

Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)

Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. Attackers can send a crafted 2000-byte buffer with specific byte patterns to the REDRAGON_MOUSE device to crash the kernel driver.

CVE-2021-47785 Crítica · 9.8 CWE-787 15/01/2026

Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH)

Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a malicious payload to overwrite SEH handlers and execute a bind shell on port 3110 by exploiting improper input validation.

CVE-2021-47781 Crítica · 9.8 CWE-787 15/01/2026

Negação de Serviço por Estouro de Buffer no Cmder Console Emulator 1.3.18

O Cmder Console Emulator 1.3.18 contém uma vulnerabilidade de estouro de buffer que permite a atacantes provocar uma condição de negação de serviço por meio de um arquivo .cmd maliciosamente elaborado. Atacantes podem criar um arquivo .cmd especialmente construído com caracteres repetidos para sobrecarregar o buffer do emulador de console e travar a aplicação.

CVE-2021-47775 Alta · 8.4 CWE-787 15/01/2026

YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)

YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious payload of 712 bytes with SEH manipulation to trigger a bind shell connection on a specified local port.

CVE-2021-47774 Crítica · 9.8 CWE-787 15/01/2026

Kingdia CD Extractor 3.0.2 - Estouro de buffer (SEH)

O Kingdia CD Extractor 3.0.2 contém uma vulnerabilidade de estouro de buffer no campo de nome de registro que permite que atacantes executem código arbitrário. Atacantes podem elaborar uma carga maliciosa com mais de 256 bytes para sobrescrever o Structured Exception Handler e obter execução remota de código por meio de um bind shell.

CVE-2021-47772 Crítica · 9.8 CWE-787 15/01/2026

10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)

10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system.

CVE-2021-47765 Média · 5.5 CWE-787 15/01/2026

AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fields. Attackers can trigger the crash by inserting 1000 characters into the username or email address fields, causing the application to become unresponsive.

CVE-2021-47764 Média · 5.5 CWE-787 15/01/2026

AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes and force unexpected termination.

CVE-2026-0962 Média · 6.5 CWE-787 14/01/2026

Out-of-bounds Write in Wireshark

SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service

CVE-2026-0961 Média · 6.5 CWE-787 14/01/2026

Out-of-bounds Write in Wireshark

BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service

CVE-2026-0959 Média · 6.5 CWE-787 14/01/2026

Out-of-bounds Write in Wireshark

IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service

CVE-2026-22853 Crítica · 9.8 CWE-787 14/01/2026

FreeRDP: estouro de buffer heap em ndr_read_uint8Array

FreeRDP é uma implementação livre do Remote Desktop Protocol. Antes da versão 3.20.1, o leitor de arrays NDR do RDPEAR não realiza verificação de limites sobre a contagem de elementos recebida pela rede e pode escrever além do buffer heap alocado a partir de hints, causando um estouro de buffer heap em ndr_read_uint8Array. Esta vulnerabilidade é corrigida na versão 3.20.1.

CVE-2026-22852 Crítica · 9.8 CWE-787 14/01/2026

FreeRDP has a heap-buffer-overflow in audin_process_formats

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability is fixed in 3.20.1.