CVE Database

CVE-2026-65395 Medium · 6.5 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Ipados

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted image may result in memory corruption.

CVE-2026-65374 High · 8.8 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Macos

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may result in code execution.

CVE-2026-65344 High · 7.8 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Ipados

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted video file may lead to unexpected app termination.

CVE-2026-64752 High · 7.3 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Ipados

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution.

CVE-2026-43815 High · 8.8 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Macos

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious afpfs server may lead to kernel memory corruption.

CVE-2026-43790 Critical · 9.1 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Macos

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-43761 Medium · 6.5 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Macos

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Mounting a malicious disk image may cause unexpected system termination.

CVE-2026-43677 Medium · 6.5 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Macos

An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may lead to unexpected app termination.

CVE-2026-28966 Medium · 4.3 CWE-787 Sep 14, 2026

Out-of-bounds Write in Apple Ipados

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-19280 Medium · 5.2 CWE-787 Sep 14, 2026

IBM i is Affected By Multiple Vulnerabilities in PASE [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

CVE-2026-54334 Critical · 9.8 CWE-787 Sep 14, 2026

UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.

CVE-2026-54333 Critical · 9.8 CWE-787 Sep 14, 2026

UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.

CVE-2026-90947 High · 7.8 CWE-787 Sep 14, 2026

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

CVE-2026-90949 High · 7.8 CWE-787 Sep 14, 2026

Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

CVE-2026-90948 High · 7.8 CWE-787 Sep 14, 2026

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

CVE-2026-82782 Medium · 4.3 CWE-787 Sep 14, 2026

Out-of-bounds Write in Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*

Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.

CVE-2026-33967 Low · 2.8 CWE-787 Sep 14, 2026

Out-of-bounds Write in Samsung Exynos 1330 Firmware

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds array access vulnerability in the error-handling path leads to memory corruption.

CVE-2026-33960 Low · 2.8 CWE-787 Sep 13, 2026

Out-of-bounds Write in Samsung Exynos 1330 Firmware

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of service (DoS).

CVE-2026-33957 Medium · 4.2 CWE-787 Sep 13, 2026

Out-of-bounds Write in Samsung Exynos 1580 Firmware

An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

CVE-2026-33956 Low · 2.8 CWE-787 Sep 13, 2026

Out-of-bounds Write in Samsung Exynos 1330 Firmware

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.

CVE-2026-23793 Low · 3.5 CWE-787 Sep 13, 2026

Out-of-bounds Write in Samsung Exynos 1330 Firmware

An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. An out-of-bounds memory access vulnerability in the camera GDC driver may lead to kernel memory corruption under certain conditions.

CVE-2026-23791 Medium · 4.2 CWE-787 Sep 13, 2026

Out-of-bounds Write in Samsung Exynos 1280 Firmware

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.

CVE-2026-90559 High · 7.5 CWE-787 Sep 12, 2026

snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

CVE-2026-89266 High · 8.2 CWE-787 Sep 11, 2026

stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

CVE-2026-78547 Medium · 4.4 CWE-787 Sep 11, 2026

Out-of-Bounds Write

Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.