Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108428
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
#msrc
共收录 2151 条相关情报。
← 返回所有主题Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108429
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108427
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108431
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108430
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-108426
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
CVE-2026-109349
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
CVE-2026-63718
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
GNU Binutils ld cache.c cache_bwrite buffer overflow
CVE-2026-90801
GNU Binutils ld cache.c cache_bwrite buffer overflow
GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption
CVE-2026-90831
GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.
CVE-2026-103658
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its
ammonia allows stored XSS through unsanitized SVG animate and set attributes
CVE-2026-102342
ammonia allows stored XSS through unsanitized SVG animate and set attributes
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
CVE-2026-49265
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
CVE-2026-49264
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
Vitess vttablet /twopcz reflected XSS
CVE-2026-104252
Vitess vttablet /twopcz reflected XSS
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
CVE-2026-109828
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
Null Pointer Dereference in PKCS#7 bundle with no certificates
CVE-2026-77207
Null Pointer Dereference in PKCS#7 bundle with no certificates
IKEv2 pre-authentication Null Pointer Dereference in EAP code
CVE-2026-77206
IKEv2 pre-authentication Null Pointer Dereference in EAP code
IKEv2 Use-After-Free bug when using IKE-over-TCP
CVE-2026-94453
IKEv2 Use-After-Free bug when using IKE-over-TCP
containerd: Unpack DoS via repeated opaque whiteouts
CVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts