CVE Database

CVE-2026-81477 High · 7.2 CWE-122 Sep 17, 2026

Heap-based Buffer Overflow in Dell Openmanage Server Administrator

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

CVE-2026-81474 High · 7.8 CWE-122 Sep 17, 2026

Heap-based Buffer Overflow in Dell Openmanage Server Administrator

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVE-2026-91106 Critical · 9.8 CWE-122 Sep 16, 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

CVE-2026-91105 Critical · 9.8 CWE-122 Sep 16, 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

CVE-2026-91104 Critical · 9.8 CWE-122 Sep 16, 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

CVE-2026-91098 Critical · 9.8 CWE-122 Sep 16, 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

CVE-2026-89028 High · 7.5 CWE-122 Sep 16, 2026

MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.

CVE-2026-82717 Critical · 9.8 CWE-122 Sep 16, 2026

CNAME synthesis could lead to heap corruption

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.

CVE-2026-81642 Critical · 9.8 Public exploit CWE-122 Sep 16, 2026

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

CVE-2026-81634 High · 7.5 CWE-122 Sep 16, 2026

Possible heap buffer overflow during DNSSEC canonicalization

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.

CVE-2026-69486 High · 8.8 CWE-122 Sep 15, 2026

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-58679 High · 8.4 CWE-122 Sep 15, 2026

Heap-based Buffer Overflow in Google Android

In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56967 High · 8.0 CWE-122 Sep 15, 2026

Heap-based Buffer Overflow in Google Android

In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55323 High · 7.8 CWE-122 Sep 15, 2026

Heap-based Buffer Overflow in Google Android

In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-19781 High · 7.8 CWE-122 Sep 15, 2026

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28173.

CVE-2026-0200 High · 8.8 CWE-122 Sep 15, 2026

Heap-based Buffer Overflow in Google Android

In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-91964 High · 8.8 CWE-122 Sep 15, 2026

FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

CVE-2026-90439 Medium · 6.5 CWE-122 Sep 15, 2026

NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-39919 Critical · 9.8 CWE-122 Sep 15, 2026

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

CVE-2026-86870 Medium · 6.5 CWE-122 Sep 14, 2026

Heap-based Buffer Overflow in Apple Ipados

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-84510 Medium · 6.5 CWE-122 Sep 14, 2026

Heap-based Buffer Overflow in Apple Ipados

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination.

CVE-2026-19499 High · 7.7 CWE-122 Sep 14, 2026

Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.

CVE-2026-23788 Medium · 4.2 CWE-122 Sep 13, 2026

Heap-based Buffer Overflow in Samsung Exynos 1280 Firmware

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver (due to improper buffer size validation) leads to kernel memory corruption and a system crash.

CVE-2025-64031 Low · 2.5 CWE-122 Sep 13, 2026

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the...

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)

CVE-2026-90556 High · 7.8 CWE-122 Sep 12, 2026

Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.