Common Weakness Enumeration
CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
3361 vulnerabilities reference this CWE, most recent first.
CVE-2026-124561 (GCVE-0-2026-124561)
Vulnerability from cvelistv5 – Published: 2026-11-09 03:15 – Updated: 2026-11-09 03:15 Unsupported When Assigned
VLAI
EPSS
VEX
Title
D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow
Summary
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432893 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432893/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124561 | third-party-advisory |
| https://vuldb.com/submit/1035617 | third-party-advisory |
| https://github.com/Zimo-666/DIR-878-cves/tree/mai… | broken-linkexploit |
| https://www.dlink.com/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:d-link:dir-878:*:*:*:*:*:*:*:*"
],
"modules": [
"HNAP Handler"
],
"product": "DIR-878",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "1.20B05"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ha ha-yang (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T03:15:50.227Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432893 | D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432893"
},
{
"name": "VDB-432893 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432893/cti"
},
{
"name": "CVE-2026-124561 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124561"
},
{
"name": "Submit #1035617 | D-Link DIR-878 1.20B05 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035617"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/Zimo-666/DIR-878-cves/tree/main/03-settriggeradic-vlan-stack-overflow"
},
{
"tags": [
"product"
],
"url": "https://www.dlink.com/"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T15:52:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124561",
"datePublished": "2026-11-09T03:15:50.227Z",
"dateReserved": "2026-11-08T14:46:56.088Z",
"dateUpdated": "2026-11-09T03:15:50.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123203 (GCVE-0-2026-123203)
Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-09 22:30
VLAI
EPSS
VEX
Title
NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens
Summary
NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:30 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/neuronsimulator/nrn/pull/3932 | issue-trackingpatch |
| https://github.com/neuronsimulator/nrn/commit/6e5… | patch |
| https://github.com/neuronsimulator/nrn/blob/ba578… | technical-description |
| https://www.vulncheck.com/advisories/neuron-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| neuronsimulator | NEURON |
Affected:
0 , ≤ 9.0.2
(custom)
cpe:2.3:a:neuron-ai:neuron:*:*:*:*:*:*:*:* |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:30:11.647263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:30:22.773Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/neuron",
"product": "NEURON",
"repo": "https://github.com/neuronsimulator/nrn",
"vendor": "neuronsimulator",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:neuron-ai:neuron:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deus Rex"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Hines (nrnhines)"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:39.093Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/neuronsimulator/nrn/pull/3932"
},
{
"tags": [
"patch"
],
"url": "https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/neuronsimulator/nrn/blob/ba5783378c0aa1d9ac95b4454bea94b15c63f75d/src/coreneuron/io/mk_mech.cpp#L81-L96"
},
{
"name": "VulnCheck Advisory: NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/neuron-through-9.0.2-stack-based-buffer-overflow-via-coreneuron-dataset-tokens"
}
],
"title": "NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123203",
"datePublished": "2026-11-05T18:16:39.093Z",
"dateReserved": "2026-11-05T17:58:50.914Z",
"dateUpdated": "2026-11-09T22:30:22.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123202 (GCVE-0-2026-123202)
Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-05 19:04
VLAI
EPSS
VEX
Title
libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name
Summary
libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 19:04 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/bakulf/libnxml/commit/fbac2423… | patch |
| https://github.com/bakulf/libnxml/releases/tag/0.18.6 | release-notes |
| https://github.com/bakulf/libnxml/blob/9272d1cd6f… | technical-description |
| https://www.vulncheck.com/advisories/libnxml-befo… | third-party-advisory |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T19:04:41.118484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:04:52.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/bakulf/libnxml",
"product": "libnxml",
"repo": "https://github.com/bakulf/libnxml",
"vendor": "bakulf",
"versions": [
{
"lessThan": "0.18.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deus Rex"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:38.397Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a"
},
{
"name": "libnxml 0.18.6 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/bakulf/libnxml/releases/tag/0.18.6"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/bakulf/libnxml/blob/9272d1cd6fee88fe7fd4fd812736d95a6ba25f2f/src/nxml_parser.c#L952-L958"
},
{
"name": "VulnCheck Advisory: libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libnxml-before-0.18.6-stack-based-buffer-overflow-via-long-multi-byte-xml-name"
}
],
"title": "libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123202",
"datePublished": "2026-11-05T18:16:38.397Z",
"dateReserved": "2026-11-05T17:58:50.610Z",
"dateUpdated": "2026-11-05T19:04:52.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123151 (GCVE-0-2026-123151)
Vulnerability from cvelistv5 – Published: 2026-11-05 16:08 – Updated: 2026-11-06 08:16
VLAI
EPSS
VEX
Title
Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail
Summary
A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:13 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-123151 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2567333 | issue-trackingx_refsource_REDHAT |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
Date Public
2026-11-05 14:58
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-123151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:13:04.424690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:13:24.847Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "gcc-toolset-14-gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "gcc-toolset-15-gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Pulkit Singh Singaria for reporting this issue."
}
],
"datePublic": "2026-11-05T14:58:55.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target\u0027s replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T08:16:19.006Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-123151"
},
{
"name": "RHBZ#2567333",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567333"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T06:59:02.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-05T14:58:55.000Z",
"value": "Made public."
}
],
"title": "Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs-\u003ebuf tail",
"workarounds": [
{
"lang": "en",
"value": "There is no mitigation for this vulnerability. Users should only connect GDB to trusted debug targets."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-123151",
"datePublished": "2026-11-05T16:08:57.397Z",
"dateReserved": "2026-11-05T15:35:02.381Z",
"dateUpdated": "2026-11-06T08:16:19.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122329 (GCVE-0-2026-122329)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:11 – Updated: 2026-11-09 16:52
VLAI
EPSS
VEX
Title
SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder
Summary
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:12 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/libsdl-org/SDL_mixer/issues/907 | issue-tracking |
| https://github.com/libsdl-org/SDL_mixer/commit/34… | patch |
| https://github.com/libsdl-org/SDL_mixer/blob/rele… | technical-description |
| https://github.com/libsdl-org/SDL_mixer/blob/rele… | technical-description |
| https://hackmd.io/@haindpwn/sdl-mixer-fetchxlaw-s… | third-party-advisory |
| https://github.com/libsdl-org/SDL_mixer | product |
| https://www.vulncheck.com/advisories/sdl-mixer-3.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libsdl-org | SDL_mixer |
Affected:
3.1.2 , ≤ 3.2.4
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:12:09.829377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:52:05.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libsdl-org/SDL_mixer",
"product": "SDL_mixer",
"repo": "https://github.com/libsdl-org/SDL_mixer",
"vendor": "libsdl-org",
"versions": [
{
"lessThanOrEqual": "3.2.4",
"status": "affected",
"version": "3.1.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ryan C. Gordon"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:47.851Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/libsdl-org/SDL_mixer/issues/907"
},
{
"tags": [
"patch"
],
"url": "https://github.com/libsdl-org/SDL_mixer/commit/34486847a607540ce9ef5fbe20979c7140bf8c82"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_aiff.c#L86-97"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_aiff.c#L535-536"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/sdl-mixer-fetchxlaw-stack-overflow"
},
{
"tags": [
"product"
],
"url": "https://github.com/libsdl-org/SDL_mixer"
},
{
"name": "VulnCheck Advisory: SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sdl-mixer-3.1.2-through-3.2.4-stack-based-buffer-overflow-via-fetchxlaw-in-aiff-decoder"
}
],
"title": "SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122329",
"datePublished": "2026-11-05T15:11:47.851Z",
"dateReserved": "2026-11-04T23:26:08.935Z",
"dateUpdated": "2026-11-09T16:52:05.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122328 (GCVE-0-2026-122328)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:11 – Updated: 2026-11-09 17:08
VLAI
EPSS
VEX
Title
SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder
Summary
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:08 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/libsdl-org/SDL_mixer/issues/907 | issue-tracking |
| https://github.com/libsdl-org/SDL_mixer/pull/910 | patchissue-tracking |
| https://github.com/libsdl-org/SDL_mixer/commit/df… | patch |
| https://github.com/libsdl-org/SDL_mixer/blob/rele… | technical-description |
| https://github.com/libsdl-org/SDL_mixer/blob/rele… | technical-description |
| https://hackmd.io/@haindpwn/sdl-mixer-fetchxlaw-s… | third-party-advisory |
| https://github.com/libsdl-org/SDL_mixer | product |
| https://www.vulncheck.com/advisories/sdl-mixer-3.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| libsdl-org | SDL_mixer |
Affected:
3.1.2 , ≤ 3.2.4
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122328",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:08:03.623773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:08:35.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/sdl-mixer-fetchxlaw-stack-overflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/libsdl-org/SDL_mixer",
"product": "SDL_mixer",
"repo": "https://github.com/libsdl-org/SDL_mixer",
"vendor": "libsdl-org",
"versions": [
{
"lessThanOrEqual": "3.2.4",
"status": "affected",
"version": "3.1.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Danonii"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:11:47.143Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/libsdl-org/SDL_mixer/issues/907"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/libsdl-org/SDL_mixer/pull/910"
},
{
"tags": [
"patch"
],
"url": "https://github.com/libsdl-org/SDL_mixer/commit/df966f698e18ae849bd92796a26311e79c555718"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_wav.c#L750-761"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/libsdl-org/SDL_mixer/blob/release-3.2.4/src/decoder_wav.c#L1658-1659"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/sdl-mixer-fetchxlaw-stack-overflow"
},
{
"tags": [
"product"
],
"url": "https://github.com/libsdl-org/SDL_mixer"
},
{
"name": "VulnCheck Advisory: SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sdl-mixer-3.1.2-through-3.2.4-stack-based-buffer-overflow-via-fetchxlaw-in-wav-decoder"
}
],
"title": "SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122328",
"datePublished": "2026-11-05T15:11:47.143Z",
"dateReserved": "2026-11-04T23:26:08.935Z",
"dateUpdated": "2026-11-09T17:08:35.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121995 (GCVE-0-2026-121995)
Vulnerability from cvelistv5 – Published: 2026-11-05 16:08 – Updated: 2026-11-09 17:18
VLAI
EPSS
VEX
Title
Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail
Summary
A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:17 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-121995 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2565677 | issue-trackingx_refsource_REDHAT |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
Date Public
2026-11-05 14:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:17:53.020811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:18:06.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gcc-toolset-14-gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gcc-toolset-15-gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Pulkit Singh Singaria for reporting this issue."
}
],
"datePublic": "2026-11-05T14:29:41.474Z",
"descriptions": [
{
"lang": "en",
"value": "A stack buffer overflow in the GDB client\u0027s tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:55:35.227Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-121995"
},
{
"name": "RHBZ#2565677",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565677"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T08:41:10.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-05T14:29:41.474Z",
"value": "Made public."
}
],
"title": "Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs-\u003ebuf tail",
"workarounds": [
{
"lang": "en",
"value": "There is no mitigation for this vulnerability. Users should only connect GDB to trusted debug targets.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to restrict GDB remote debugging sessions to trusted remote stubs and prevent connections to untrusted endpoints: upgrade to the corresponding fixed Red Hat builds, which apply the documented input check, closing crafted qTsP remote debug response following a longer qTfP response. Until patched, this is a concern on Linux systems running GDB remote debugging sessions connecting to remote debug targets, so Only initiate target remote debugging sessions to verified, trusted debug stubs and targets. As a compensating measure, Run SELinux in enforcing mode to confine GDB execution under mandatory access control and limit the blast radius of memory corruption. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack buffer overflow defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)"
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-121995",
"datePublished": "2026-11-05T16:08:49.660Z",
"dateReserved": "2026-11-04T13:28:12.839Z",
"dateUpdated": "2026-11-09T17:18:06.930Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121994 (GCVE-0-2026-121994)
Vulnerability from cvelistv5 – Published: 2026-11-05 16:08 – Updated: 2026-11-06 19:55
VLAI
EPSS
VEX
Title
Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length
Summary
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 00:00 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-121994 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2565676 | issue-trackingx_refsource_REDHAT |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
Date Public
2026-11-05 14:25
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T04:56:37.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gcc-toolset-14-gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gcc-toolset-15-gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "crash",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "gdb",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Pulkit Singh Singaria for reporting this issue."
}
],
"datePublic": "2026-11-05T14:25:22.606Z",
"descriptions": [
{
"lang": "en",
"value": "A stack buffer overflow in the GDB client\u0027s remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub\u0027s register reply into an alloca-sized buffer without bounding writes by the register width."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:55:31.918Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-121994"
},
{
"name": "RHBZ#2565676",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565676"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T08:41:10.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-05T14:25:22.606Z",
"value": "Made public."
}
],
"title": "Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length",
"workarounds": [
{
"lang": "en",
"value": "There is no mitigation for this vulnerability. Users should only connect GDB to trusted debug targets.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce bounds checking against register size when decoding remote serial protocol register replies in the GDB client remote protocol handler: upgrade to the corresponding fixed Red Hat builds, which bounds RSP register reply decoding to the allocated register size rather than terminating only on NUL bytes, closing all 2 injection vectors (oversized RSP register reply, truncated RSP register reply stack disclosure). Until patched, this is a concern on Linux systems running GDB clients connecting to remote RSP debug targets, so Only connect the GDB client to known, trusted debug targets and avoid attaching to unverified or hostile remote RSP stubs. As a compensating measure, Enforce SELinux in enforcing mode to confine the actions of a compromised GDB process, Deploy an EDR agent to detect anomalous process behavior and post-exploitation payloads spawned from GDB, Monitor kernel syscall activity via eBPF to detect unexpected commands or shells spawned by the GDB client, Enable Address Space Layout Randomization to randomize userspace memory addresses, and Enable the NX/XD bit to block direct shellcode execution from stack memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack buffer overflow defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)"
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-121994",
"datePublished": "2026-11-05T16:08:46.589Z",
"dateReserved": "2026-11-04T13:28:12.838Z",
"dateUpdated": "2026-11-06T19:55:31.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121969 (GCVE-0-2026-121969)
Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:27
VLAI
EPSS
VEX
Title
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
Summary
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 19:27 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quozl/netrek-client-cow/commit… | patch |
| https://github.com/quozl/netrek-client-cow | product |
| https://github.com/quozl/netrek-client-cow/blob/3… | technical-description |
| https://github.com/quozl/netrek-client-cow/issues/11 | issue-tracking |
| https://www.vulncheck.com/advisories/netrek-clien… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quozl | netrek-client-cow |
Affected:
0 , ≤ 3.3.3
(custom)
|
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T19:27:04.770622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:27:21.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "netrek-client-cow",
"vendor": "quozl",
"versions": [
{
"lessThanOrEqual": "3.3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deus Rex"
},
{
"lang": "en",
"type": "remediation developer",
"value": "James Cameron"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:36:47.609Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127"
},
{
"tags": [
"product"
],
"url": "https://github.com/quozl/netrek-client-cow"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/quozl/netrek-client-cow/issues/11"
},
{
"name": "VulnCheck Advisory: netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage"
}
],
"title": "netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121969",
"datePublished": "2026-11-04T20:36:47.609Z",
"dateReserved": "2026-11-04T12:48:39.813Z",
"dateUpdated": "2026-11-05T19:27:21.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121925 (GCVE-0-2026-121925)
Vulnerability from cvelistv5 – Published: 2026-11-04 11:28 – Updated: 2026-11-04 20:00
VLAI
EPSS
VEX
Title
Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver
Summary
A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's HTML response into a fixed-size memory buffer without first validating the length of that value. An attacker who controlled or had compromised the configured identity provider — or who was able to redirect the SAML single sign-on endpoint to an attacker-controlled server — might have leveraged this by returning an oversized response, potentially resulting in a crash or, in specific circumstances, remote code execution within the context of the application running the library. The fix is available in libsnowflakeclient version 2.11.1 and Snowflake PHP PDO Driver version 4.3.0. Users must manually upgrade.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:20 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
SNOWFLAKE
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Snowflake | Snowflake PHP PDO Driver |
Affected:
3.2.0 , < 4.3.0
(semver)
|
|
| Snowflake | Snowflake Libsnowflakeclient |
Affected:
2.1.0 , < 2.11.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:20:10.577872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:00:57.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Snowflake PHP PDO Driver",
"repo": "https://github.com/snowflakedb/pdo_snowflake",
"vendor": "Snowflake",
"versions": [
{
"lessThan": "4.3.0",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Snowflake Libsnowflakeclient",
"repo": "https://github.com/snowflakedb/libsnowflakeclient",
"vendor": "Snowflake",
"versions": [
{
"lessThan": "2.11.1",
"status": "affected",
"version": "2.1.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider\u0027s HTML response into a fixed-size memory buffer without first validating the length of that value. An attacker who controlled or had compromised the configured identity provider \u2014 or who was able to redirect the SAML single sign-on endpoint to an attacker-controlled server \u2014 might have leveraged this by returning an oversized response, potentially resulting in a crash or, in specific circumstances, remote code execution within the context of the application running the library. The fix is available in libsnowflakeclient version 2.11.1 and Snowflake PHP PDO Driver version 4.3.0. Users must manually upgrade."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T11:28:56.733Z",
"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea",
"shortName": "SNOWFLAKE"
},
"references": [
{
"name": "Snowflake PHP PDO Driver Release Notes",
"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-430-oct-1-2026"
},
{
"name": "Snowflake Libsnowflakeclient Release Notes",
"url": "https://github.com/snowflakedb/libsnowflakeclient/releases/tag/v2.11.1"
}
],
"title": "Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea",
"assignerShortName": "SNOWFLAKE",
"cveId": "CVE-2026-121925",
"datePublished": "2026-11-04T11:28:56.733Z",
"dateReserved": "2026-11-04T11:24:43.550Z",
"dateUpdated": "2026-11-04T20:00:57.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.