Common Weakness Enumeration
CWE-787
Allowed-with-ReviewOut-of-bounds Write
Abstraction: Base · Status: Draft
The product writes data past the end, or before the beginning, of the intended buffer.
16575 vulnerabilities reference this CWE, most recent first.
CVE-2026-116842 (GCVE-0-2026-116842)
Vulnerability from cvelistv5 – Published: 2026-10-27 00:34 – Updated: 2026-10-27 00:34
VLAI
EPSS
VEX
Title
DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
Summary
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
Severity
6.1 (Medium)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/diasurgical/DevilutionX/issues/8758 | issue-tracking |
| https://github.com/diasurgical/DevilutionX/pull/8482 | patchissue-tracking |
| https://github.com/diasurgical/libmpq/blob/b78d66… | technical-description |
| https://github.com/diasurgical/DevilutionX/blob/7… | technical-description |
| https://hackmd.io/@haindpwn/devilutionx-libmpq-ha… | technical-description |
| https://www.vulncheck.com/advisories/devilutionx-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diasurgical | DevilutionX |
Affected:
1.4.0 , ≤ 1.5.5
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/diasurgical/DevilutionX",
"product": "DevilutionX",
"vendor": "diasurgical",
"versions": [
{
"lessThanOrEqual": "1.5.5",
"status": "affected",
"version": "1.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T00:34:01.167Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/diasurgical/DevilutionX/issues/8758"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/diasurgical/DevilutionX/pull/8482"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/diasurgical/libmpq/blob/b78d66c6fee6a501cc9b95d8556a129c68841b05/libmpq/mpq.c#L505"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/diasurgical/DevilutionX/blob/7223eeac9e8274fbf665b4de86fda26d3b22c52f/3rdParty/libmpq/CMakeLists.txt"
},
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haindpwn/devilutionx-libmpq-hash-block-table-oob"
},
{
"name": "VulnCheck Advisory: DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/devilutionx-1.4.0-through-1.5.5-heap-buffer-overflow-via-libmpq-archive-dup"
}
],
"title": "DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116842",
"datePublished": "2026-10-27T00:34:01.167Z",
"dateReserved": "2026-10-27T00:10:22.758Z",
"dateUpdated": "2026-10-27T00:34:01.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116741 (GCVE-0-2026-116741)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-26 21:52
VLAI
EPSS
VEX
Title
Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
Summary
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/xiph/speex/issues/42 | issue-tracking |
| https://github.com/xiph/speex | product |
| https://github.com/xiph/speex/blob/Speex-1.2.1/li… | technical-description |
| https://hackmd.io/@haindpwn/speex-bits-read-whole… | third-party-advisory |
| https://gitlab.xiph.org/xiph/speex/-/merge_requests/32 | patch |
| https://www.vulncheck.com/advisories/speex-throug… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/xiph/speex",
"product": "speex",
"repo": "https://github.com/xiph/speex",
"vendor": "xiph",
"versions": [
{
"lessThanOrEqual": "1.2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xiph:speex:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:52:40.782Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #42",
"tags": [
"issue-tracking"
],
"url": "https://github.com/xiph/speex/issues/42"
},
{
"tags": [
"product"
],
"url": "https://github.com/xiph/speex"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.xiph.org/xiph/speex/-/merge_requests/32"
},
{
"name": "VulnCheck Advisory: Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes"
}
],
"title": "Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116741",
"datePublished": "2026-10-26T21:52:40.782Z",
"dateReserved": "2026-10-26T20:23:36.495Z",
"dateUpdated": "2026-10-26T21:52:40.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116590 (GCVE-0-2026-116590)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:48 – Updated: 2026-10-26 21:48
VLAI
EPSS
VEX
Title
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
Summary
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.
Severity
5.9 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/xerial/snappy-java/security/ad… | x_refsource_CONFIRM |
| https://github.com/xerial/snappy-java/pull/741 | x_refsource_MISC |
| https://github.com/xerial/snappy-java/commit/2d7c… | x_refsource_MISC |
| https://github.com/xerial/snappy-java/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xerial | snappy-java |
Affected:
< 1.1.10.9
|
{
"containers": {
"cna": {
"affected": [
{
"product": "snappy-java",
"vendor": "xerial",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.10.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:48:15.468Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7"
},
{
"name": "https://github.com/xerial/snappy-java/pull/741",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xerial/snappy-java/pull/741"
},
{
"name": "https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b"
},
{
"name": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"
}
],
"source": {
"advisory": "GHSA-xqrx-qh46-34m7",
"discovery": "UNKNOWN"
},
"title": "snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-116590",
"datePublished": "2026-10-26T21:48:15.468Z",
"dateReserved": "2026-10-26T15:03:39.036Z",
"dateUpdated": "2026-10-26T21:48:15.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116543 (GCVE-0-2026-116543)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:59 – Updated: 2026-10-26 14:59
VLAI
EPSS
VEX
Title
Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser
Summary
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/open5gs/open5gs/security/advis… | vendor-advisory |
| https://github.com/open5gs/open5gs/commit/6820c27… | patch |
| https://github.com/open5gs/open5gs/blob/v2.8.0/li… | technical-description |
| https://github.com/open5gs/open5gs/blob/v2.8.0/li… | technical-description |
| https://github.com/open5gs/open5gs | product |
| https://www.vulncheck.com/advisories/open5gs-1.3.… | third-party-advisory |
Impacted products
Date Public
2026-09-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "open5gs",
"repo": "https://github.com/open5gs/open5gs",
"vendor": "open5gs",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.8.0",
"versionStartIncluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eun0us / Espilon"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:59:42.212Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-25v2-v588-jq8g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260"
},
{
"tags": [
"product"
],
"url": "https://github.com/open5gs/open5gs"
},
{
"name": "VulnCheck Advisory: Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parser"
}
],
"title": "Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116543",
"datePublished": "2026-10-26T14:59:42.212Z",
"dateReserved": "2026-10-26T14:30:58.865Z",
"dateUpdated": "2026-10-26T14:59:42.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116539 (GCVE-0-2026-116539)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:59 – Updated: 2026-10-26 14:59
VLAI
EPSS
VEX
Title
Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
Summary
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/netty/netty-tcnative/security/… | vendor-advisory |
| https://github.com/netty/netty-tcnative/commit/92… | patch |
| https://github.com/netty/netty-tcnative/blob/nett… | technical-description |
| https://github.com/netty/netty-tcnative/releases/… | release-notes |
| https://github.com/netty/netty-tcnative | product |
| https://www.vulncheck.com/advisories/netty-netty-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| netty | netty-tcnative |
Affected:
0 , < 2.0.84.Final
(custom)
|
|
| netty | netty-tcnative-boringssl-static |
Affected:
0 , < 2.0.84.Final
(custom)
|
Date Public
2026-08-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative/",
"defaultStatus": "unaffected",
"packageName": "io.netty:netty-tcnative",
"packageURL": "pkg:maven/io.netty/netty-tcnative",
"product": "netty-tcnative",
"repo": "https://github.com/netty/netty-tcnative",
"vendor": "netty",
"versions": [
{
"lessThan": "2.0.84.Final",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/",
"defaultStatus": "unaffected",
"packageName": "io.netty:netty-tcnative-boringssl-static",
"packageURL": "pkg:maven/io.netty/netty-tcnative-boringssl-static",
"product": "netty-tcnative-boringssl-static",
"repo": "https://github.com/netty/netty-tcnative",
"vendor": "netty",
"versions": [
{
"lessThan": "2.0.84.Final",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:59:39.460Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gf9q-9mg7-g5qh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/netty/netty-tcnative/security/advisories/GHSA-gf9q-9mg7-g5qh"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/netty/netty-tcnative/commit/92dd66fd1243d85c05a61288f96367a70260b6b8"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L199"
},
{
"name": "netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final"
},
{
"tags": [
"product"
],
"url": "https://github.com/netty/netty-tcnative"
},
{
"name": "VulnCheck Advisory: Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-heap-buffer-overflow-via-openssl-bio"
}
],
"title": "Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116539",
"datePublished": "2026-10-26T14:59:39.460Z",
"dateReserved": "2026-10-26T14:30:57.254Z",
"dateUpdated": "2026-10-26T14:59:39.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116502 (GCVE-0-2026-116502)
Vulnerability from cvelistv5 – Published: 2026-10-26 20:15 – Updated: 2026-10-26 20:15
VLAI
EPSS
VEX
Title
turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write
Summary
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426401 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426401/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116502 | third-party-advisory |
| https://vuldb.com/submit/1022425 | third-party-advisory |
| https://github.com/turboderp-org/exllamav2/issues/817 | issue-tracking |
| https://github.com/turboderp-org/exllamav2/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| turboderp-org | ExLlamaV2 |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 cpe:2.3:a:turboderp-org:exllamav2:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:turboderp-org:exllamav2:*:*:*:*:*:*:*:*"
],
"modules": [
"GPTQ Index Handler"
],
"product": "ExLlamaV2",
"vendor": "turboderp-org",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "m00dy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T20:15:07.238Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426401 | turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426401"
},
{
"name": "VDB-426401 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426401/cti"
},
{
"name": "CVE-2026-116502 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116502"
},
{
"name": "Submit #1022425 | turboderp-org / ExLlamaV2 exllamav2 0.0.4 - 0.3.2 Heap out-of-bounds write caused by an unvalidated GPTQ `g_idx` v",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022425"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/turboderp-org/exllamav2/issues/817"
},
{
"tags": [
"product"
],
"url": "https://github.com/turboderp-org/exllamav2/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-26T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-26T14:11:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116502",
"datePublished": "2026-10-26T20:15:07.238Z",
"dateReserved": "2026-10-26T13:06:50.894Z",
"dateUpdated": "2026-10-26T20:15:07.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116099 (GCVE-0-2026-116099)
Vulnerability from cvelistv5 – Published: 2026-10-25 23:45 – Updated: 2026-10-26 16:38
VLAI
EPSS
VEX
Title
Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write
Summary
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 16:08 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426167 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426167/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116099 | third-party-advisory |
| https://vuldb.com/submit/1001276 | third-party-advisory |
| https://drbloop.dev/blog/one-click-remote-code-ex… | related |
| https://store.steampowered.com/news/app/1782380/v… | related |
| https://github.com/drbloop2000/SCP-CBM-RCE/tree/main | exploit |
| https://steamdb.info/patchnotes/25701366/ | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fusion Creators Studio | SCP Containment Breach Multiplayer |
Affected:
1.295
Unaffected: 1.3R cpe:2.3:a:fusion_creators_studio:scp_containment_breach_multiplayer:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116099",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T16:08:28.144079Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:38:24.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fusion_creators_studio:scp_containment_breach_multiplayer:*:*:*:*:*:*:*:*"
],
"modules": [
"Skynet++ Virtual Machine"
],
"product": "SCP Containment Breach Multiplayer",
"vendor": "Fusion Creators Studio",
"versions": [
{
"status": "affected",
"version": "1.295"
},
{
"status": "unaffected",
"version": "1.3R"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T06:11:40.873Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426167 | Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426167"
},
{
"name": "VDB-426167 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426167/cti"
},
{
"name": "CVE-2026-116099 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116099"
},
{
"name": "Submit #1001276 | Fusion Creators Studio SCP: Containment Breach Multiplayer 24934269 Out-of-bounds Write",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1001276"
},
{
"tags": [
"related"
],
"url": "https://drbloop.dev/blog/one-click-remote-code-execution-in-scp-containment-breach-mutiplayer"
},
{
"tags": [
"related"
],
"url": "https://store.steampowered.com/news/app/1782380/view/670629296167978253"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/drbloop2000/SCP-CBM-RCE/tree/main"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://steamdb.info/patchnotes/25701366/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-26T07:16:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116099",
"datePublished": "2026-10-25T23:45:16.547Z",
"dateReserved": "2026-10-25T07:16:43.544Z",
"dateUpdated": "2026-10-26T16:38:24.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116096 (GCVE-0-2026-116096)
Vulnerability from cvelistv5 – Published: 2026-10-25 23:00 – Updated: 2026-10-26 16:38 X_Open Source
VLAI
EPSS
VEX
Title
ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
Summary
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:59 UTC
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426164 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426164/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116096 | third-party-advisory |
| https://vuldb.com/submit/1000891 | third-party-advisory |
| https://github.com/3em0/cve_repo/tree/main/2026/l… | exploit |
| https://github.com/ggml-org/llama.cpp/pull/30902 | issue-trackingpatch |
| https://github.com/3em0/cve_repo/tree/main/2026/l… | exploit |
| https://github.com/ggml-org/llama.cpp/commit/0a1e… | patch |
| https://github.com/ggml-org/llama.cpp/releases/ta… | patch |
| https://github.com/ggml-org/llama.cpp/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116096",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:59:49.571700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:38:49.498Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*"
],
"modules": [
"Pocket-TTS"
],
"product": "llama.cpp",
"vendor": "ggml-org",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.17.1"
},
{
"status": "affected",
"version": "55abc39"
},
{
"status": "affected",
"version": "55d4206c8"
},
{
"status": "affected",
"version": "b5693"
},
{
"status": "affected",
"version": "b7445"
},
{
"status": "affected",
"version": "b7824"
},
{
"status": "affected",
"version": "b8492"
},
{
"status": "affected",
"version": "b8585"
},
{
"status": "affected",
"version": "b9058"
},
{
"status": "affected",
"version": "b9060"
},
{
"status": "unaffected",
"version": "b11796"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out\u2011of\u2011bounds write (gen\u2011audio / pocket\u2011tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release\u2011active GGML_ASSERT and aborts. But the submitter\u0027s recommended by\u2011construction fix (PR #29360 \"prevent OOB accesses from malformed mmproj files\") is still open. So the root cause is detected\u2011and\u2011aborted, not prevented\u2011by\u2011design."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T23:00:24.282Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426164 | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426164"
},
{
"name": "VDB-426164 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426164/cti"
},
{
"name": "CVE-2026-116096 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116096"
},
{
"name": "Submit #1000891 | ggml-org xxxxxxxxxx\u00a0llama.cpp up to main commit 8212c7802455255460ab8e18fc34754560031b34 (latest release b11160, 2026-09-24) Out-of-Bounds Write (CWE-787)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1000891"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/pull/30902"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/commit/0a1ef309cdbb9f2024f58a38fb4c42352c5db569"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/releases/tag/b11796"
},
{
"tags": [
"product"
],
"url": "https://github.com/ggml-org/llama.cpp/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T08:00:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116096",
"datePublished": "2026-10-25T23:00:24.282Z",
"dateReserved": "2026-10-25T06:55:29.373Z",
"dateUpdated": "2026-10-26T16:38:49.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115723 (GCVE-0-2026-115723)
Vulnerability from cvelistv5 – Published: 2026-10-23 11:36 – Updated: 2026-10-23 14:59
VLAI
EPSS
VEX
Title
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Summary
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/davenardella/snap7/pull/41 | issue-trackingpatch |
| https://github.com/davenardella/snap7/blob/30f37d… | technical-description |
| https://github.com/davenardella/snap7/blob/30f37d… | technical-description |
| https://www.vulncheck.com/advisories/snap7-throug… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davenardella | snap7 |
Affected:
0 , ≤ 1.4.3
(custom)
cpe:2.3:a:snap7_project:snap7:*:*:*:*:*:*:*:* |
Date Public
2026-10-21 10:46
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:43.225515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T14:59:52.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/davenardella/snap7",
"product": "snap7",
"repo": "https://github.com/davenardella/snap7",
"vendor": "davenardella",
"versions": [
{
"lessThanOrEqual": "1.4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snap7_project:snap7:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Telmo Xavier"
}
],
"datePublic": "2026-10-21T10:46:07.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T11:36:47.011Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/davenardella/snap7/pull/41"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L1126-L1166"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_partner.cpp#L850-L867"
},
{
"name": "VulnCheck Advisory: Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-brecv-and-checkasbrecvcompletion"
}
],
"title": "Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115723",
"datePublished": "2026-10-23T11:36:47.011Z",
"dateReserved": "2026-10-23T11:26:42.748Z",
"dateUpdated": "2026-10-23T14:59:52.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115504 (GCVE-0-2026-115504)
Vulnerability from cvelistv5 – Published: 2026-10-22 19:14 – Updated: 2026-10-22 19:14
VLAI
EPSS
VEX
Title
CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
Summary
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gist.github.com/yure1432/98f15c7e8f48dc90… | technical-descriptionexploit |
| https://github.com/HEASARC/cfitsio/pull/184 | patchissue-tracking |
| https://github.com/HEASARC/cfitsio/commit/579792e… | patch |
| https://github.com/HEASARC/cfitsio | product |
| https://www.vulncheck.com/advisories/cfitsio-thro… | third-party-advisory |
Date Public
2026-09-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "cfitsio",
"repo": "https://github.com/HEASARC/cfitsio",
"vendor": "HEASARC",
"versions": [
{
"lessThanOrEqual": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pratyaksh Srivats"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller\u0027s string array, enabling arbitrary code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:14:04.552Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://gist.github.com/yure1432/98f15c7e8f48dc90ae65646f926aa176"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/HEASARC/cfitsio/pull/184"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HEASARC/cfitsio/commit/579792e0f85bff0c6733ad5ebdf54c3b5c188686"
},
{
"tags": [
"product"
],
"url": "https://github.com/HEASARC/cfitsio"
},
{
"name": "VulnCheck Advisory: CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-out-of-bounds-write-via-ffgcls2-in-getcols-c"
}
],
"title": "CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115504",
"datePublished": "2026-10-22T19:14:04.552Z",
"dateReserved": "2026-10-22T16:14:58.754Z",
"dateUpdated": "2026-10-22T19:14:04.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
- Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
- Consider adhering to the following rules when allocating and managing an application's memory:
- Double check that the buffer is as large as specified.
- When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
- Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
- If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation
Strategy: Environment Hardening
- Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
- For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
No CAPEC attack patterns related to this CWE.