Common Weakness Enumeration

CWE-787

Allowed-with-Review

Out-of-bounds Write

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product writes data past the end, or before the beginning, of the intended buffer.

16670 vulnerabilities reference this CWE, most recent first.

CVE-2026-119777 (GCVE-0-2026-119777)

Vulnerability from cvelistv5 – Published: 2026-10-30 17:59 – Updated: 2026-10-30 19:20

Title

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

Summary

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 19:16 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1086 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-119777	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564164	issue-trackingx_refsource_REDHAT
https://gitlab.freedesktop.org/gstreamer/gstreame…

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-04-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119777",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T19:16:55.995158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T19:20:39.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-04-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GStreamer\u0027s gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T17:59:41.041Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-119777"
        },
        {
          "name": "RHBZ#2564164",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564164"
        },
        {
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-07T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-07T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no complete mitigation for this vulnerability. As a risk-reduction measure, disable H.266/VVC media ingestion in GStreamer-based applications and media pipelines where that feature is not required. Until a fixed package is available, do not open or transcode H.266/VVC files or streams from untrusted sources."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-119777",
    "datePublished": "2026-10-30T17:59:41.041Z",
    "dateReserved": "2026-10-30T16:19:44.205Z",
    "dateUpdated": "2026-10-30T19:20:39.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119601 (GCVE-0-2026-119601)

Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-10-30 13:18

Title

AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

Summary

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7156 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/sshock/AFFLIBv3/issues/61	issue-tracking
https://github.com/sshock/AFFLIBv3/blob/v3.7.22/l…	technical-description
https://hackmd.io/@haindpwn/afflib-aff-get-page-s…	third-party-advisory
https://github.com/sshock/AFFLIBv3	product
https://www.vulncheck.com/advisories/afflib-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sshock	AFFLIB	Affected: 0 , ≤ 3.7.22 (semver) cpe:2.3:a:afflib_project:afflib::::::::

Date Public

2026-10-21 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/sshock/AFFLIBv3",
          "product": "AFFLIB",
          "repo": "https://github.com/sshock/AFFLIBv3",
          "vendor": "sshock",
          "versions": [
            {
              "lessThanOrEqual": "3.7.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:afflib_project:afflib:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.7.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T13:18:19.851Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/sshock/AFFLIBv3/issues/61"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sshock/AFFLIBv3/blob/v3.7.22/lib/afflib_pages.cpp#L309-L315"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/afflib-aff-get-page-sector-fill-oob-write"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sshock/AFFLIBv3"
        },
        {
          "name": "VulnCheck Advisory: AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/afflib-through-3.7.22-heap-out-of-bounds-write-in-af-get-page"
        }
      ],
      "title": "AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119601",
    "datePublished": "2026-10-30T13:18:19.851Z",
    "dateReserved": "2026-10-30T11:46:46.896Z",
    "dateUpdated": "2026-10-30T13:18:19.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119379 (GCVE-0-2026-119379)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 16:02

Title

SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

Summary

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 15:54 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7156 records in the last 180 days details

References

8 references

URL	Tags
https://sqlite.org/bugs/info/2026-08-16T10:15:25Z	issue-tracking
https://sqlite.org/src/info/3f57024aecea0f3b	patch
https://github.com/sqlite/sqlite/commit/64459c87c…	patch
https://github.com/sqlite/sqlite/blob/version-3.5…	technical-description
https://sqlite.org/releaselog/3_54_0.html	release-notes
https://abraxaslabs.tech/research/sqlite-session-ncol	third-party-advisory
https://github.com/sqlite/sqlite	product
https://www.vulncheck.com/advisories/sqlite-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
SQLite	SQLite	Affected: 0 , < 3.54.0 (custom) cpe:2.3:a:sqlite:sqlite::::::::

Date Public

2026-08-16 00:00

Credits

Marc Heuse Abraxas Labs Dan Kennedy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:54:31.625606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T16:02:09.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://sqlite.org/",
          "defaultStatus": "unaffected",
          "platforms": [
            "All platforms where SQLITE_ENABLE_SESSION is defined"
          ],
          "product": "SQLite",
          "repo": "https://github.com/sqlite/sqlite",
          "vendor": "SQLite",
          "versions": [
            {
              "lessThan": "3.54.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.54.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marc Heuse"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Abraxas Labs"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Kennedy"
        }
      ],
      "datePublic": "2026-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:43.335Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://sqlite.org/src/info/3f57024aecea0f3b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://sqlite.org/releaselog/3_54_0.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/sqlite-session-ncol"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sqlite/sqlite"
        },
        {
          "name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"
        }
      ],
      "title": "SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119379",
    "datePublished": "2026-10-30T11:30:43.335Z",
    "dateReserved": "2026-10-30T00:57:06.710Z",
    "dateUpdated": "2026-10-30T16:02:09.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119374 (GCVE-0-2026-119374)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56

Title

SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

Summary

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 15:34 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7156 records in the last 180 days details

References

7 references

URL	Tags
https://sqlite.org/src/info/9cd4f9e920	patch
https://github.com/sqlite/sqlite/commit/d9de6eedb…	patch
https://github.com/sqlite/sqlite/blob/version-3.5…	technical-description
https://sqlite.org/releaselog/3_54_0.html	release-notes
https://abraxaslabs.tech/research/sqlite-fts5-securedel	third-party-advisory
https://github.com/sqlite/sqlite	product
https://www.vulncheck.com/advisories/sqlite-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
SQLite	SQLite	Affected: 0 , < 3.54.0 (custom) cpe:2.3:a:sqlite:sqlite::::::::

Date Public

2026-08-11 00:00

Credits

YEONBA Abraxas Labs Dan Kennedy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:34:49.257415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:56:39.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://sqlite.org/",
          "defaultStatus": "unaffected",
          "platforms": [
            "All platforms where SQLITE_ENABLE_FTS5 is defined"
          ],
          "product": "SQLite",
          "repo": "https://github.com/sqlite/sqlite",
          "vendor": "SQLite",
          "versions": [
            {
              "lessThan": "3.54.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.54.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "YEONBA"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Abraxas Labs"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Kennedy"
        }
      ],
      "datePublic": "2026-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:39.834Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://sqlite.org/src/info/9cd4f9e920"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://sqlite.org/releaselog/3_54_0.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/sqlite-fts5-securedel"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sqlite/sqlite"
        },
        {
          "name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"
        }
      ],
      "title": "SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119374",
    "datePublished": "2026-10-30T11:30:39.834Z",
    "dateReserved": "2026-10-30T00:39:33.151Z",
    "dateUpdated": "2026-10-30T15:56:39.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119373 (GCVE-0-2026-119373)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30

Title

SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()

Summary

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7156 records in the last 180 days details

References

8 references

URL	Tags
https://sqlite.org/bugs/info/2026-08-04T08:49:27Z	issue-tracking
https://sqlite.org/src/info/a7f8c92f62	patch
https://github.com/sqlite/sqlite/commit/e1c9934f9…	patch
https://github.com/sqlite/sqlite/blob/version-3.5…	technical-description
https://sqlite.org/releaselog/3_54_0.html	release-notes
https://abraxaslabs.tech/research/sqlite-fts5-row…	third-party-advisory
https://github.com/sqlite/sqlite	product
https://www.vulncheck.com/advisories/sqlite-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
SQLite	SQLite	Affected: 0 , < 3.54.0 (custom) cpe:2.3:a:sqlite:sqlite::::::::

Date Public

2026-08-04 00:00

Credits

Michele Abraxas Labs Dan Kennedy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://sqlite.org/",
          "defaultStatus": "unaffected",
          "platforms": [
            "All platforms where SQLITE_ENABLE_FTS5 is defined"
          ],
          "product": "SQLite",
          "repo": "https://github.com/sqlite/sqlite",
          "vendor": "SQLite",
          "versions": [
            {
              "lessThan": "3.54.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.54.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michele"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Abraxas Labs"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Kennedy"
        }
      ],
      "datePublic": "2026-08-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:39.153Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://sqlite.org/src/info/a7f8c92f62"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://sqlite.org/releaselog/3_54_0.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sqlite/sqlite"
        },
        {
          "name": "VulnCheck Advisory: SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"
        }
      ],
      "title": "SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119373",
    "datePublished": "2026-10-30T11:30:39.153Z",
    "dateReserved": "2026-10-30T00:39:32.759Z",
    "dateUpdated": "2026-10-30T11:30:39.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118769 (GCVE-0-2026-118769)

Vulnerability from cvelistv5 – Published: 2026-10-29 17:22 – Updated: 2026-10-29 20:21

Title

Botan: Integer overflow when reporting block size in FFI can cause memory corruption

Summary

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 20:20 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-681 - Incorrect Conversion between Numeric Types
CWE-787 - Out-of-bounds Write

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8129 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/randombit/botan/security/advis…	x_refsource_CONFIRM
https://github.com/randombit/botan/pull/5805	x_refsource_MISC
https://github.com/randombit/botan/commit/c6089ab…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
randombit	botan	Affected: >= 2.1.0, < 3.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:20:31.067238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:21:04.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "botan",
          "vendor": "randombit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 3.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-681",
              "description": "CWE-681: Incorrect Conversion between Numeric Types",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T17:22:07.316Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/randombit/botan/security/advisories/GHSA-c68p-822g-jfvr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/randombit/botan/security/advisories/GHSA-c68p-822g-jfvr"
        },
        {
          "name": "https://github.com/randombit/botan/pull/5805",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/randombit/botan/pull/5805"
        },
        {
          "name": "https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3"
        }
      ],
      "source": {
        "advisory": "GHSA-c68p-822g-jfvr",
        "discovery": "UNKNOWN"
      },
      "title": "Botan: Integer overflow when reporting block size in FFI can cause memory corruption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118769",
    "datePublished": "2026-10-29T17:22:07.316Z",
    "dateReserved": "2026-10-28T19:20:05.017Z",
    "dateUpdated": "2026-10-29T20:21:04.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118753 (GCVE-0-2026-118753)

Vulnerability from cvelistv5 – Published: 2026-10-28 21:11 – Updated: 2026-10-28 21:11

Title

FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing

Summary

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7156 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/danoli3/FreeImage/pull/183	issue-trackingpatch
https://github.com/danoli3/FreeImage/commit/96f40…	patch
https://github.com/danoli3/FreeImage	product
https://github.com/danoli3/FreeImage/blob/3.19.24…	technical-description
https://github.com/danoli3/FreeImage/commit/0da5d…	patch
https://github.com/danoli3/FreeImage/releases/tag…	release-notes
https://www.vulncheck.com/advisories/freeimage-da…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
danoli3	FreeImage	Affected: 0 , < 3.19.25 (semver) Unaffected: 3.19.25 (semver)
FreeImage	FreeImage	Affected: 0 , ≤ 3.18.0 (semver)

Date Public

2026-10-17 00:00

Credits

danoli3 Tristan Madani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/danoli3/FreeImage",
          "product": "FreeImage",
          "repo": "https://github.com/danoli3/FreeImage",
          "vendor": "danoli3",
          "versions": [
            {
              "lessThan": "3.19.25",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.19.25",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FreeImage",
          "vendor": "FreeImage",
          "versions": [
            {
              "lessThanOrEqual": "3.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.18.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "danoli3"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        }
      ],
      "datePublic": "2026-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T21:11:22.192Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request #183",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/danoli3/FreeImage/pull/183"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/danoli3/FreeImage"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034"
        },
        {
          "name": "FreeImage 3.19.25 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.25"
        },
        {
          "name": "VulnCheck Advisory: FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playback-compositing"
        }
      ],
      "title": "FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118753",
    "datePublished": "2026-10-28T21:11:22.192Z",
    "dateReserved": "2026-10-28T19:13:08.786Z",
    "dateUpdated": "2026-10-28T21:11:22.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118752 (GCVE-0-2026-118752)

Vulnerability from cvelistv5 – Published: 2026-10-28 21:11 – Updated: 2026-10-28 21:11

Title

FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

Summary

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7156 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/danoli3/FreeImage/issues/156	issue-tracking
https://github.com/danoli3/FreeImage	product
https://github.com/danoli3/FreeImage/blob/3.19.21…	technical-description
https://github.com/danoli3/FreeImage/pull/161	patchissue-tracking
https://github.com/danoli3/FreeImage/commit/e1105…	patch
https://github.com/danoli3/FreeImage/commit/cf173…	patch
https://github.com/danoli3/FreeImage/releases/tag…	release-notes
https://www.vulncheck.com/advisories/freeimage-be…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
danoli3	FreeImage	Affected: 0 , < 3.19.22 (semver)
FreeImage	FreeImage	Affected: 0 , ≤ 3.18.0 (semver)

Date Public

2026-10-12 00:00

Credits

areofyl Tristan Madani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/danoli3/FreeImage",
          "product": "FreeImage",
          "repo": "https://github.com/danoli3/FreeImage",
          "vendor": "danoli3",
          "versions": [
            {
              "lessThan": "3.19.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FreeImage",
          "vendor": "FreeImage",
          "versions": [
            {
              "lessThanOrEqual": "3.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freeimage_project:freeimage:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.18.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "areofyl"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani"
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T21:11:21.485Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #156",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/danoli3/FreeImage/issues/156"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/danoli3/FreeImage"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/danoli3/FreeImage/pull/161"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45"
        },
        {
          "name": "FreeImage 3.19.22 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/danoli3/FreeImage/releases/tag/3.19.22"
        },
        {
          "name": "VulnCheck Advisory: FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder"
        }
      ],
      "title": "FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118752",
    "datePublished": "2026-10-28T21:11:21.485Z",
    "dateReserved": "2026-10-28T19:13:08.429Z",
    "dateUpdated": "2026-10-28T21:11:21.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118673 (GCVE-0-2026-118673)

Vulnerability from cvelistv5 – Published: 2026-10-29 16:01 – Updated: 2026-10-29 16:01

Title

KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses

Summary

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.

Severity

4.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8129 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/keepassxreboot/keepassxc/secur…	x_refsource_CONFIRM
https://github.com/keepassxreboot/keepassxc/pull/13679	x_refsource_MISC
https://github.com/keepassxreboot/keepassxc/commi…	x_refsource_MISC
https://github.com/keepassxreboot/keepassxc/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
keepassxreboot	keepassxc	Affected: >= 2.3.0, < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "keepassxc",
          "vendor": "keepassxreboot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T16:01:55.635Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227"
        },
        {
          "name": "https://github.com/keepassxreboot/keepassxc/pull/13679",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/keepassxreboot/keepassxc/pull/13679"
        },
        {
          "name": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa"
        },
        {
          "name": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3448-gh8j-3227",
        "discovery": "UNKNOWN"
      },
      "title": "KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118673",
    "datePublished": "2026-10-29T16:01:55.635Z",
    "dateReserved": "2026-10-28T17:25:37.562Z",
    "dateUpdated": "2026-10-29T16:01:55.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118435 (GCVE-0-2026-118435)

Vulnerability from cvelistv5 – Published: 2026-10-28 07:49 – Updated: 2026-10-28 07:54

Summary

Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE

CWE-787 - Out-of-bounds write

Assigner

samsung.tv_appliance CNA under the mitre root

CNA scorecard C 63/100 over 47 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Samsung/escargot/pull/1750

Impacted products

1 product

Vendor	Product	Version
Samsung Open Source	escargot	Unaffected: 09db346

Credits

Pranjal Kumar Singh

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "escargot",
          "vendor": "Samsung Open Source",
          "versions": [
            {
              "status": "unaffected",
              "version": "09db346"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pranjal Kumar Singh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation."
            }
          ],
          "value": "Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-123",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-123 Buffer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T07:54:29.600Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "url": "https://github.com/Samsung/escargot/pull/1750"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2026-118435",
    "datePublished": "2026-10-28T07:49:14.205Z",
    "dateReserved": "2026-10-28T07:47:05.646Z",
    "dateUpdated": "2026-10-28T07:54:29.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation MIT-3

Requirements

Strategy: Language Selection

Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.

Mitigation MIT-4.1

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Mitigation MIT-10

Operation Build and Compilation

Strategy: Environment Hardening

Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.

Mitigation MIT-9

Implementation

Consider adhering to the following rules when allocating and managing an application's memory:
Double check that the buffer is as large as specified.
When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.

Mitigation MIT-11

Operation Build and Compilation

Strategy: Environment Hardening

Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

Mitigation MIT-12

Operation

Strategy: Environment Hardening

Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].

Mitigation MIT-13

Implementation

Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list