Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108432
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
2026-10-16 归档
今日共收录 833 条安全情报，包含 0 个 CVE，434 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-108434
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft Office Word Security Feature Bypass Vulnerability
CVE-2026-108433
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a
Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-108436
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108428
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108429
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108427
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108431
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108430
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108426
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
CVE-2026-109349
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
CVE-2026-63718
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
GNU Binutils ld cache.c cache_bwrite buffer overflow
CVE-2026-90801
GNU Binutils ld cache.c cache_bwrite buffer overflow
GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption
CVE-2026-90831
GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.
CVE-2026-103658
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its
ammonia allows stored XSS through unsanitized SVG animate and set attributes
CVE-2026-102342
ammonia allows stored XSS through unsanitized SVG animate and set attributes
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
CVE-2026-49265
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
CVE-2026-49264
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
Vitess vttablet /twopcz reflected XSS
CVE-2026-104252
Vitess vttablet /twopcz reflected XSS
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
CVE-2026-109828
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable