#cwe-787

共收录 1314 条相关情报。

← 返回所有主题
漏洞预警2026-09-29 发布INFO

Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craf...

CVE-2026-95329

Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentia

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code out...

CVE-2026-95322

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compr

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium secur...

CVE-2026-95304

Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code in

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the curr...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU en...

CVE-2026-102757

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata pa...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **wri

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the th...

CVE-2026-102729

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a...

CVE-2026-102715

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. Th

历史摘要 · 未重新核验 · NVD

安全公告2026-09-29 发布INFO

CVE-2026-102729

CVE-2026-102729

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-29 发布INFO

mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet

CVE-2026-102715

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. Th

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-29 发布INFO

CVE-2026-102761

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-29 发布INFO

CVE-2026-102757

CVE-2026-102757

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-29 发布INFO

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an intern...

CVE-2026-72897

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index vali...

CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craf...

CVE-2026-102566

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload

历史摘要 · 未重新核验 · NVD

安全公告2026-09-29 发布INFO

Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-29 发布INFO

CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CVE-2026-102566

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-29 发布INFO

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an...

CVE-2026-95520

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared R

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execu...

CVE-2026-15390

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user w...

CVE-2026-102474

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the mu

历史摘要 · 未重新核验 · NVD