CVE Database

CVE-2026-20493 Medium · 4.4 CWE-787 Aug 3, 2026

In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead...

In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575.

CVE-2026-20491 Medium · 5.5 CWE-787 Aug 3, 2026

In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead...

In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.

CVE-2026-20485 Medium · 6.0 CWE-787 Aug 3, 2026

In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead...

In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931.

CVE-2026-20481 Medium · 6.0 CWE-787 Aug 3, 2026

In geniezone, there is a possible out of bounds write due to a missing bounds check. This could...

In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935.

CVE-2026-20478 Medium · 5.5 CWE-787 Aug 3, 2026

In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could...

In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.

CVE-2026-20477 Medium · 6.0 CWE-787 Aug 3, 2026

In display, there is a possible out of bounds write due to a missing bounds check. This could...

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11009963; Issue ID: MSV-7658.

CVE-2026-20476 Medium · 5.5 CWE-787 Aug 3, 2026

In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to...

In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981532; Issue ID: MSV-7660.

CVE-2026-20475 Medium · 6.0 CWE-787 Aug 3, 2026

In display, there is a possible out of bounds write due to a missing bounds check. This could...

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748.

CVE-2026-20472 Medium · 4.4 CWE-787 Aug 3, 2026

In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to...

In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10991467; Issue ID: MSV-7764.

CVE-2026-20471 Medium · 4.6 CWE-787 Aug 3, 2026

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to...

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10991588 (Note: For MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Note: For MT2735, MT2737); Issue ID: MSV-7790.

CVE-2026-20468 Medium · 6.0 CWE-787 Aug 3, 2026

In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead...

In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741.

CVE-2026-20466 Medium · 6.1 CWE-787 Aug 3, 2026

In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This...

In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: AUTO00845351 (Note: For MT2737) / ALPS11072643 (Note: For MT6880, MT6890, MT6990); Issue ID: MSV-6929.

CVE-2026-20464 Medium · 6.5 CWE-787 Aug 3, 2026

In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could...

In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297.

CVE-2026-68579 Critical · 9.6 CWE-787 Aug 2, 2026

FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read

FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) instead of cb. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.

CVE-2026-34641 High · 7.8 CWE-787 Jul 31, 2026

Premiere Pro | Out-of-bounds Write (CWE-787)

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-47876 Critical · 9.3 CWE-787 Jul 30, 2026

VMXNET3 out-of-bounds write vulnerability

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

CVE-2026-17544 Critical · 9.8 CWE-787 Jul 30, 2026

Out-of-bounds write in bccomp() via crafted operand and scale

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

CVE-2026-17727 Critical · 9.6 CWE-787 Jul 29, 2026

Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote...

Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17721 Critical · 9.6 CWE-787 Jul 29, 2026

Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to...

Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17691 Critical · 9.6 CWE-787 Jul 29, 2026

Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote...

Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17675 Critical · 9.6 CWE-787 Jul 29, 2026

Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker...

Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-62363 Medium · 5.0 CWE-787 Jul 29, 2026

ImageMagick: Heap Buffer Over-Write in fx operation

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27.

CVE-2026-12927 High · 8.4 CWE-787 Jul 29, 2026

CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially...

CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is imported to IGSS Definition.

CVE-2026-18220 High · 7.8 CWE-787 Jul 29, 2026

Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation type number space is non-contiguous (basic types 0-6, extended types at 0x10000+), but the default case in the switch statement allows arbitrary index values to reach the array access. A specially crafted ELF/DLX object file can trigger this out-of-bounds write when processed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The vulnerability has been demonstrated to achieve arbitrary code execution via a File Stream Oriented Programming (FSOP) attack against glibc FILE structures (stderr), redirecting control flow to system(). Attack scenarios include CI/CD pipelines performing automated binary analysis, developer workstations running objdump/readelf on untrusted binaries, automated security scanning or malware analysis tools invoking binutils, and package build systems processing third-party code. Note: This vulnerability is only exploitable when binutils is built with the DLX backend enabled (typically via --enable-targets=all).

CVE-2026-58188 High · 8.2 CWE-787 Jul 29, 2026

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.