Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

1.700 result(s)

Export this search: RSS · CSV · STIX

CVE-2026-111458 Medium · 6.8 CWE-122 Oct 16, 2026

ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting

The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.

CVE-2026-111381 High · 7.3 CWE-122 Oct 16, 2026

FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.

CVE-2026-111379 High · 7.3 CWE-122 Oct 16, 2026

FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.

CVE-2026-108451 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108450 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108449 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108448 High · 7.5 CWE-122 Oct 15, 2026

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

CVE-2026-108447 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108444 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

CVE-2026-108441 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108439 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108437 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108432 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108430 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108429 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108428 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-108426 High · 8.8 CWE-122 Oct 15, 2026

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVE-2026-55246 High · 7.8 CWE-122 Oct 15, 2026

bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.

CVE-2026-79831 Medium · 6.6 CWE-122 Oct 15, 2026

HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.

CVE-2026-79828 High · 7.1 CWE-122 Oct 15, 2026

HPE NonStop Debug Utilities - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.

CVE-2026-79827 High · 7.1 CWE-122 Oct 15, 2026

HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

CVE-2026-79826 High · 7.1 CWE-122 Oct 15, 2026

HPE NonStop OCAX - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.

CVE-2026-79825 High · 7.1 CWE-122 Oct 15, 2026

HPE NonStop NDSREST - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.

CVE-2026-79822 High · 7.1 CWE-122 Oct 15, 2026

HPE NonStop TNS/X Native Inspect - Execution flow vulnerability

A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

CVE-2026-101307 High · 8.2 CWE-122 Oct 15, 2026

Remotely triggerable buffer overflow in tcp_rack

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.