CWE-120
CVEs classified under CWE-120, newest first.
517 CVEsRSS
CVE-2026-57191High· 8.2Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `M…
CVE-2026-93857Critical· 9.2Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
CVE-2026-82944High· 8.8Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative…
CVE-2026-82945Medium· 6.5Memory Corruption via FMMU Configuration Table Overflow
SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index ex…
CVE-2026-97631High· 8.8edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)
A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service…
CVE-2026-114268Critical· 9.9Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible t…
CVE-2026-92183High· 7.80daygimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser (CVE-2026-92183)
A flaw was found in GIMP. This flaw allows an attacker to achieve arbitrary code execution by tricking a user into opening a specially crafted Animated Portable Network Graphics (APNG) image. The vulnerability is caused by a stack-based bu…
CVE-2023-7356High· 8.8Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Au…
CVE-2026-101103Medium· 5.5HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow
The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record.
CVE-2026-11828Medium· 5.9IBM MQ Buffer Overflow
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of …
CVE-2026-11829Medium· 6.5IBM MQ Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.
CVE-2026-112107Medium· 6.3PoCztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offset…
CVE-2026-112108Medium· 6.3PoCztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer o…
CVE-2026-98730Medium· 6.7kernel: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() (CVE-2026-98730)
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface (HCI) user channel can inject an oversized transmission packet. Because the driver fails to validate pa…
CVE-2026-102693Critical· 9.6RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID w…
CVE-2025-29897Low· 2.3A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have alread…
CVE-2026-0993High· 7.5PoCSODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a cr…
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a cr…
CVE-2026-110695Medium· 6.3PoCA vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offs…
CVE-2026-102176High· 8.8A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Rout…
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Rout…
CVE-2016-15060High· 8.3PoCA vulnerability was found in PCMan FTP Server up to 2.0.7
A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been mad…
CVE-2026-95124High· 7.5PoCBuffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()
CVE-2026-53420High· 8.0Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
CVE-2025-58772High· 8.2AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, …
CVE-2026-108954Medium· 6.3PoCA vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8
A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline …
CVE-2026-108915Critical· 9.9PoCA vulnerability has been found in Edimax BR-6208AC 1.32
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has …
CVE-2026-108914Critical· 9.9PoCA flaw has been found in Edimax BR-6208AC 1.32
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack…
CVE-2026-108822Medium· 5.3A vulnerability was detected in Kamailio up to 6.0.7/6.1.3
A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length resul…
CVE-2026-15340Critical· 9.8lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
CVE-2026-19570High· 8.8The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without an…
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without an…
CVE-2026-84246High· 8.1IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.