CVE-2026-123200High· 7.5▾ TwilightVRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length i…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.
VRPN <= 07.36Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-2008High· 8.2A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler
CVE-2026-116783High· 8.2FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
CVE-2026-121968Medium· 6.5Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
CVE-2026-75614High· 8.1ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)
CVE-2026-75615Medium· 5.3ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders
CVE-2025-66366NoneIncorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash