CWE-787
CVEs classified under CWE-787, newest first.
1686 CVEsRSS
CVE-2026-19595Medium· 6.1Zephyr RTIO syscall verifier validates output parameters for read instead of write access
The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure o…
CVE-2026-76788High· 8.8Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload le…
CVE-2026-110680High· 7.5Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second…
CVE-2026-112275Medium· 6.1Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and…
CVE-2026-98741High· 7.8kernel: ALSA: ua101: reject mismatched capture/playback packet sizes (CVE-2026-98741)
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initiali…
CVE-2026-98770Medium· 4.4kernel: usb: gadget: midi2: Fix the jack descriptor array sizes (CVE-2026-98770)
A flaw was found in the Linux kernel's USB gadget MIDI 2.0 driver. Under-sized descriptor arrays allow a local user to trigger an out-of-bounds memory access when setting up a large number of MIDI jacks through the configuration filesystem…
CVE-2026-98769High· 8.4kernel: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (CVE-2026-98769)
A flaw was found in the Linux kernel's Universal Serial Bus (USB) audio gadget driver. A connected USB host can send a specially crafted audio control request with an invalid command index, causing an out-of-bounds heap memory read and wri…
CVE-2026-98808Medium· 6.7kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (CVE-2026-98808)
A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. …
CVE-2026-98824Medium· 5.3kernel: wifi: mac80211: validate TX status rate metadata (CVE-2026-98824)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. When processing transmission (TX) status reports, the subsystem fails to properly validate rate metadata before using it to index internal rate tables. Malformed metadata …
CVE-2026-98827Medium· 5.3kernel: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE (CVE-2026-98827)
A flaw was found in the Linux kernel's ath9k_htc wireless network driver. An attacker transmitting large network packets can trigger a Denial of Service (DoS) or system crash through memory corruption. This issue occurs because the driver …
CVE-2026-98830Medium· 5.5wifi: wfx: validate MIB read length before copying to caller
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer w…
CVE-2026-98836Medium· 6.2kernel: ALSA: line6: reject oversized playback packets (CVE-2026-98836)
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) Line 6 USB audio driver. The driver fails to validate the size of playback packets against the allocated memory buffer slice when handling asymmetrical audio c…
CVE-2026-98848Medium· 4.1kernel: rtc: ac100: Assign .num before accessing .hws (CVE-2026-98848)
A flaw was found in the Linux kernel's AC100 Real-Time Clock (RTC) driver. During device probing, the driver accesses an internal array before initializing its element counter. On systems compiled with runtime bounds checking enabled, this…
CVE-2026-98867Medium· 4.4kernel: dm-pcache: bound the logical key offset from persistent memory (CVE-2026-98867)
A flaw was found in the Linux kernel's Device Mapper persistent cache (dm-pcache) module. A local attacker capable of mounting or attaching a crafted persistent cache device can exploit missing boundary checks on logical key offsets. This …
CVE-2026-98456Medium· 4.1⚖ disputedkernel: Bluetooth: mgmt: fix race in read_unconf_index_list() (CVE-2026-98456)
A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the read_unconf_index_list() function allows a local user to cause an out-of-bounds write during asynchronous controller setup. This issue occurs when device s…
CVE-2026-98475Medium· 5.1kernel: s390/cmf: Fix virtual vs physical address confusion (CVE-2026-98475)
A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresse…
CVE-2026-98518Medium· 5.5kernel: drm/nouveau/dmem: pin VRAM for the whole registered range (CVE-2026-98518)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local user to cause a denial of service (DoS) or system instability through an out-of-bounds memory access in video random-access memory (VRAM). Th…
CVE-2026-98532High· 7.5kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end (CVE-2026-98532)
A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service (DoS) or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the decl…
CVE-2026-98545Medium· 6.2kernel: ata: libata-scsi: bound the ATA passthru sense descriptor writes (CVE-2026-98545)
A flaw was found in the Linux kernel's libata SCSI subsystem. When processing ATA pass-through commands to an ATAPI storage device, the kernel fails to properly validate the length byte returned in the device's sense response buffer. A mal…
CVE-2026-98568Medium· 4.7kernel: vxlan: use one headroom snapshot for neighbour replies (CVE-2026-98568)
A flaw was found in the Linux kernel's VXLAN (Virtual Extensible LAN) networking module. A race condition can occur when link properties are modified while neighbour advertisement reply packets are being processed, leading to inconsistent …
CVE-2026-98567Medium· 5.5kernel: net: xps: reject an out of range traffic class (CVE-2026-98567)
A flaw was found in the Linux kernel. A local privileged user could trigger a Denial of Service (DoS) or kernel memory corruption by causing an out-of-bounds memory write. This issue occurs in the Transmit Packet Steering (XPS) networking …
CVE-2026-98570Medium· 5.9kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() (CVE-2026-98570)
A flaw was found in the Linux kernel's IPv6 networking subsystem. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending network traffic through an affected IPv6 tunnel interface. Due to insufficient buffer alloc…
CVE-2026-98566Medium· 5.5kernel: drm/imagination: clamp freelist reconstruction requests (CVE-2026-98566)
A flaw was found in the Linux kernel's drm/imagination GPU driver. The driver fails to properly validate and bound the firmware reconstruction count against the fixed protocol array capacity when processing freelist reconstruction requests…
CVE-2026-112059Medium· 6.1PoClibLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variabl…
CVE-2026-112060Medium· 6.4PoClibrtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized…
CVE-2026-112007Medium· 6.1PoCSchism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrite…
CVE-2026-112008Medium· 6.1PoClibmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. …
CVE-2026-112012Medium· 5.3PoClibtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count
libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta f…
CVE-2026-112018High· 7.0PoCcgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or…
CVE-2026-111880High· 7.4FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward s…