Common Weakness Enumeration
CWE-122
AllowedHeap-based Buffer Overflow
Abstraction: Variant · Status: Draft
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
3349 vulnerabilities reference this CWE, most recent first.
CVE-2026-121950 (GCVE-0-2026-121950)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:33 – Updated: 2026-11-04 18:42
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
Summary
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE_SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:42 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121950",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:42:28.554814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:42:53.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f53w-3364-jr35"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "iPlayForSG"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE_SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:33:16.620Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f53w-3364-jr35)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f53w-3364-jr35"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-overflow-via-rdpgfx-create-surface-integer-wrap"
}
],
"title": "FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121950",
"datePublished": "2026-11-04T15:33:16.620Z",
"dateReserved": "2026-11-04T12:46:55.473Z",
"dateUpdated": "2026-11-04T18:42:53.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121941 (GCVE-0-2026-121941)
Vulnerability from cvelistv5 – Published: 2026-11-04 12:31 – Updated: 2026-11-04 20:18
VLAI
EPSS
VEX
Title
libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
Summary
libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:17 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/munt/munt/issues/149 | issue-tracking |
| https://hackmd.io/@haindpwn/munt-midistreamparser… | third-party-advisory |
| https://github.com/munt/munt/commit/1749f7fed5cdb… | patch |
| https://github.com/munt/munt/blob/libmt32emu_2_8_… | technical-description |
| https://www.vulncheck.com/advisories/libmt32emu-b… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-121941-munt-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| munt | libmt32emu |
Affected:
0 , < 2.8.4
(semver)
|
Date Public
2026-11-01 10:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121941",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:17:29.860940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:18:07.407Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-121941-munt-midistreamparser-oversized-sysex-heap-overflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/munt/munt",
"product": "libmt32emu",
"repo": "https://github.com/munt/munt",
"vendor": "munt",
"versions": [
{
"lessThan": "2.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-11-01T10:29:26.000Z",
"descriptions": [
{
"lang": "en",
"value": "libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T12:31:19.851Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/munt/munt/issues/149"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/munt-midistreamparser-oversized-sysex-heap-overflow"
},
{
"tags": [
"patch"
],
"url": "https://github.com/munt/munt/commit/1749f7fed5cdb3a9015acce076a1512b1615dc3b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/munt/munt/blob/libmt32emu_2_8_3/mt32emu/src/MidiStreamParser.cpp#L223-L257"
},
{
"name": "VulnCheck Advisory: libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libmt32emu-before-2.8.4-heap-buffer-overflow-via-midistreamparserimpl-parsesysex"
}
],
"title": "libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121941",
"datePublished": "2026-11-04T12:31:19.851Z",
"dateReserved": "2026-11-04T12:05:50.249Z",
"dateUpdated": "2026-11-04T20:18:07.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121602 (GCVE-0-2026-121602)
Vulnerability from cvelistv5 – Published: 2026-11-03 16:26 – Updated: 2026-11-03 18:08
VLAI
EPSS
VEX
Title
Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN
Summary
Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:47 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/solanum-ircd/solanum/pull/551 | issue-trackingpatch |
| https://github.com/solanum-ircd/solanum/commit/2c… | patch |
| https://github.com/solanum-ircd/solanum/blob/2ea1… | technical-description |
| https://github.com/solanum-ircd/solanum/blob/2ea1… | technical-description |
| https://github.com/solanum-ircd/solanum | product |
| https://www.vulncheck.com/advisories/solanum-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| solanum-ircd | solanum |
Affected:
0 , < 2ce64debf65e9710e9eea099ada93dbf6655b5ff
(git)
|
Date Public
2026-08-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:47:30.495862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:08:37.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/solanum-ircd/solanum",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/solanum-ircd/solanum",
"product": "solanum",
"repo": "https://github.com/solanum-ircd/solanum",
"vendor": "solanum-ircd",
"versions": [
{
"lessThan": "2ce64debf65e9710e9eea099ada93dbf6655b5ff",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "aaronmdjones"
}
],
"datePublic": "2026-08-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:26:54.160Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/solanum-ircd/solanum/pull/551"
},
{
"tags": [
"patch"
],
"url": "https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385"
},
{
"tags": [
"product"
],
"url": "https://github.com/solanum-ircd/solanum"
},
{
"name": "VulnCheck Advisory: Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin"
}
],
"title": "Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121602",
"datePublished": "2026-11-03T16:26:54.160Z",
"dateReserved": "2026-11-03T16:19:15.723Z",
"dateUpdated": "2026-11-03T18:08:37.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121517 (GCVE-0-2026-121517)
Vulnerability from cvelistv5 – Published: 2026-11-03 21:00 – Updated: 2026-11-07 03:35 X_Freeware
VLAI
EPSS
VEX
Title
IrfanView TIFF Wang Annotation heap-based overflow
Summary
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:34 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430288 | vdb-entry |
| https://vuldb.com/vuln/430288/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121517 | third-party-advisory |
| https://vuldb.com/submit/1018543 | third-party-advisory |
| https://github.com/dwBruijn/CVEs/blob/main/IrfanV… | exploit |
| https://www.irfanview.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121517",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:34:57.730522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:35:18.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:irfanview:irfanview:*:*:*:*:*:*:*:*"
],
"modules": [
"TIFF Wang Annotation Handler"
],
"product": "IrfanView",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "4.76.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dwbruijn (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.1,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T21:00:15.953Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430288 | IrfanView TIFF Wang Annotation heap-based overflow",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/430288"
},
{
"name": "VDB-430288 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430288/cti"
},
{
"name": "CVE-2026-121517 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121517"
},
{
"name": "Submit #1018543 | IrfanView 4.76.0.0 (x64) Heap-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018543"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md"
},
{
"tags": [
"product"
],
"url": "https://www.irfanview.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:27:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "IrfanView TIFF Wang Annotation heap-based overflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121517",
"datePublished": "2026-11-03T21:00:15.953Z",
"dateReserved": "2026-11-03T14:22:35.275Z",
"dateUpdated": "2026-11-07T03:35:18.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120775 (GCVE-0-2026-120775)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:29
VLAI
EPSS
VEX
Title
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
Summary
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:29 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
Tanium
CNA
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:29:05.998551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:29:17.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Deploy",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.45.322",
"status": "affected",
"version": "2.45.0",
"versionType": "custom"
},
{
"lessThan": "2.40.235",
"status": "affected",
"version": "2.40.0",
"versionType": "custom"
},
{
"lessThan": "2.36.294",
"status": "affected",
"version": "2.36.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-11-02T21:54:16.128Z",
"datePublic": "2026-11-03T22:12:10.312Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a heap-based buffer overflow vulnerability in Deploy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:24.355Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-089",
"url": "https://security.tanium.com/TAN-2026-089"
}
],
"title": "Tanium addressed a heap-based buffer overflow vulnerability in Deploy."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-120775",
"datePublished": "2026-11-03T22:17:24.355Z",
"dateReserved": "2026-11-02T21:54:16.642Z",
"dateUpdated": "2026-11-06T19:29:17.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120431 (GCVE-0-2026-120431)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:28 – Updated: 2026-11-06 19:28
VLAI
EPSS
VEX
Title
Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow
Summary
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:27 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/netpbm/code/5317/ | patch |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/531… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/531… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/537… | release-notes |
| https://svn.code.sf.net/p/netpbm/code/!svn/bc/531… | technical-description |
| https://www.vulncheck.com/advisories/netpbm-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:27:23.324500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:28:27.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Netpbm",
"vendor": "Netpbm",
"versions": [
{
"lessThan": "10.86.51",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.02.29",
"status": "affected",
"version": "11.0",
"versionType": "custom"
},
{
"lessThan": "11.15.07",
"status": "affected",
"version": "11.03",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.86.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.02.29",
"versionStartIncluding": "11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netpbm_project:netpbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.15.07",
"versionStartIncluding": "11.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Bryan Henderson"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm\u0027s readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:28:55.731Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sourceforge.net/p/netpbm/code/5317/"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5319/stable/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5318/advanced/doc/HISTORY"
},
{
"tags": [
"release-notes"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY"
},
{
"tags": [
"technical-description"
],
"url": "https://svn.code.sf.net/p/netpbm/code/!svn/bc/5316/trunk/converter/other/sgitopnm.c"
},
{
"name": "VulnCheck Advisory: Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.29-and-11.15.07-sgitopnm-heap-buffer-overflow"
}
],
"title": "Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120431",
"datePublished": "2026-11-02T14:28:55.731Z",
"dateReserved": "2026-11-02T12:42:12.344Z",
"dateUpdated": "2026-11-06T19:28:27.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120208 (GCVE-0-2026-120208)
Vulnerability from cvelistv5 – Published: 2026-10-31 17:25 – Updated: 2026-11-02 17:45
VLAI
EPSS
VEX
Title
libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder
Summary
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/strukturag/libheif/security/ad… | vendor-advisory |
| https://github.com/strukturag/libheif/commit/9d3c… | patch |
| https://github.com/strukturag/libheif/releases/ta… | release-notes |
| https://github.com/strukturag/libheif/blob/v1.23.… | technical-description |
| https://www.vulncheck.com/advisories/libheif-1.18… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| strukturag | libheif |
Affected:
1.18.0 , < 1.23.3
(semver)
|
Date Public
2026-09-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:44.328658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:45:27.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libheif",
"repo": "https://github.com/strukturag/libheif",
"vendor": "strukturag",
"versions": [
{
"lessThan": "1.23.3",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Thomas (Wordfence)"
},
{
"lang": "en",
"type": "finder",
"value": "poppo25"
},
{
"lang": "en",
"type": "tool",
"value": "Wordfence Argus"
}
],
"datePublic": "2026-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T17:25:55.507Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x8r2-mggj-j6wr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-x8r2-mggj-j6wr"
},
{
"tags": [
"patch"
],
"url": "https://github.com/strukturag/libheif/commit/9d3cd91d7b1c8c68deef6d06057ab956bcb0dfb9"
},
{
"name": "libheif v1.23.3 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/strukturag/libheif/releases/tag/v1.23.3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/strukturag/libheif/blob/v1.23.2/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc#L95"
},
{
"name": "VulnCheck Advisory: libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libheif-1.18.0-before-1.23.3-heap-buffer-overflow-via-unci-mixed-interleave-decoder"
}
],
"title": "libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120208",
"datePublished": "2026-10-31T17:25:55.507Z",
"dateReserved": "2026-10-31T11:44:49.238Z",
"dateUpdated": "2026-11-02T17:45:27.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119923 (GCVE-0-2026-119923)
Vulnerability from cvelistv5 – Published: 2026-11-06 18:35 – Updated: 2026-11-07 21:32
VLAI
EPSS
VEX
Title
Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser
Summary
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.
To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 20:26 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
AMZN
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/babelfish-for-postgresql/babel… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | babelfish-for-postgresql |
Affected:
1.0 , ≤ 1.5
(custom)
Affected: 2.1 , ≤ 2.15 (custom) Affected: 3.1 , ≤ 3.12 (custom) Affected: 4.0 , ≤ 4.8 (custom) Affected: 5.1 , ≤ 5.4 (custom) cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* |
|
| Amazon | Amazon Aurora PostgreSQL with Babelfish |
Affected:
1.0.0 , < 1.5.5
(custom)
Affected: 1.6.0 , < 1.17.2 (custom) Affected: 2.0.0 , < 2.3.5 (custom) Affected: 2.4.0 , < 2.12.4 (custom) Affected: 2.13.0 , < 2.13.3 (custom) Affected: 2.14.0 , < 2.14.2 (custom) Affected: 2.15.0 , < 2.15.2 (custom) Affected: 2.16.0 , < 2.16.1 (custom) Affected: 3.0.0 , < 3.8.4 (custom) Affected: 3.9.0 , < 3.9.4 (custom) Affected: 3.10.0 , < 3.10.3 (custom) Affected: 3.11.0 , < 3.11.2 (custom) Affected: 3.12.0 , < 3.12.2 (custom) Affected: 3.13.0 , < 3.13.1 (custom) Affected: 4.0.0 , < 4.5.5 (custom) Affected: 4.6.0 , < 4.6.3 (custom) Affected: 4.7.0 , < 4.7.2 (custom) Affected: 4.8.0 , < 4.8.2 (custom) Affected: 4.9.0 , < 4.9.1 (custom) Affected: 5.0.0 , < 5.1.4 (custom) Affected: 5.2.0 , < 5.2.3 (custom) Affected: 5.3.0 , < 5.3.2 (custom) Affected: 5.4.0 , < 5.4.2 (custom) Affected: 5.5.0 (custom) Affected: 6.0.0 , < 6.0.2 (custom) cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:5.5.0:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T20:26:32.395882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T20:26:39.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "babelfish-for-postgresql",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "1.5",
"status": "affected",
"version": "1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.15",
"status": "affected",
"version": "2.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.12",
"status": "affected",
"version": "3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.8",
"status": "affected",
"version": "4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Amazon Aurora PostgreSQL with Babelfish",
"vendor": "Amazon",
"versions": [
{
"lessThan": "1.5.5",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "1.17.2",
"status": "affected",
"version": "1.6.0",
"versionType": "custom"
},
{
"lessThan": "2.3.5",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
},
{
"lessThan": "2.12.4",
"status": "affected",
"version": "2.4.0",
"versionType": "custom"
},
{
"lessThan": "2.13.3",
"status": "affected",
"version": "2.13.0",
"versionType": "custom"
},
{
"lessThan": "2.14.2",
"status": "affected",
"version": "2.14.0",
"versionType": "custom"
},
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.15.0",
"versionType": "custom"
},
{
"lessThan": "2.16.1",
"status": "affected",
"version": "2.16.0",
"versionType": "custom"
},
{
"lessThan": "3.8.4",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.9.4",
"status": "affected",
"version": "3.9.0",
"versionType": "custom"
},
{
"lessThan": "3.10.3",
"status": "affected",
"version": "3.10.0",
"versionType": "custom"
},
{
"lessThan": "3.11.2",
"status": "affected",
"version": "3.11.0",
"versionType": "custom"
},
{
"lessThan": "3.12.2",
"status": "affected",
"version": "3.12.0",
"versionType": "custom"
},
{
"lessThan": "3.13.1",
"status": "affected",
"version": "3.13.0",
"versionType": "custom"
},
{
"lessThan": "4.5.5",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.6.3",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.2",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
},
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.8.0",
"versionType": "custom"
},
{
"lessThan": "4.9.1",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "5.1.4",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.3",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.3.2",
"status": "affected",
"version": "5.3.0",
"versionType": "custom"
},
{
"lessThan": "5.4.2",
"status": "affected",
"version": "5.4.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.5.0",
"versionType": "custom"
},
{
"lessThan": "6.0.2",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.5",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.15",
"versionStartIncluding": "2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.12",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.8",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.5",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17.2",
"versionStartIncluding": "1.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.5",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.4",
"versionStartIncluding": "2.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.3",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.2",
"versionStartIncluding": "2.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.16.1",
"versionStartIncluding": "2.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.8.4",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.9.4",
"versionStartIncluding": "3.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.3",
"versionStartIncluding": "3.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.11.2",
"versionStartIncluding": "3.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.12.2",
"versionStartIncluding": "3.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.13.1",
"versionStartIncluding": "3.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.5",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.2",
"versionStartIncluding": "4.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.2",
"versionStartIncluding": "4.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.1",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.1.4",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.3",
"versionStartIncluding": "5.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.2",
"versionStartIncluding": "5.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.2",
"versionStartIncluding": "5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:5.5.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.2",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.\u003c/p\u003e\u003cp\u003eTo remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.\u003c/p\u003e"
}
],
"value": "A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.\n\n\n\nTo remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T21:32:19.471Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-166-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-vq28-vgj3-r26w"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-119923",
"datePublished": "2026-11-06T18:35:49.413Z",
"dateReserved": "2026-10-30T16:59:42.199Z",
"dateUpdated": "2026-11-07T21:32:19.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119727 (GCVE-0-2026-119727)
Vulnerability from cvelistv5 – Published: 2026-10-30 18:51 – Updated: 2026-11-05 17:05
VLAI
EPSS
VEX
Title
Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation
Summary
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 20:17 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
redhat
CNA
References
4 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-119727 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2564118 | issue-trackingx_refsource_REDHAT |
| https://gitlab.freedesktop.org/gstreamer/gstreame… | |
| https://gstreamer.freedesktop.org/security/sa-202… |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
Date Public
2026-02-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119727",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T20:17:33.616559Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:17:40.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gstreamer1-plugins-bad-free",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-02-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in GStreamer\u0027s gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:05:14.261Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-119727"
},
{
"name": "RHBZ#2564118",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564118"
},
{
"url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10902.patch"
},
{
"url": "https://gstreamer.freedesktop.org/security/sa-2026-0012.html"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-02-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation",
"workarounds": [
{
"lang": "en",
"value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-119727",
"datePublished": "2026-10-30T18:51:08.851Z",
"dateReserved": "2026-10-30T15:05:36.023Z",
"dateUpdated": "2026-11-05T17:05:14.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119124 (GCVE-0-2026-119124)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:58 – Updated: 2026-11-03 15:42
VLAI
EPSS
VEX
Title
ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
Summary
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 15:41 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ImageMagick/ImageMagick/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/imagemagick-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ImageMagick | ImageMagick |
Affected:
0 , < 7.1.2-34
(semver)
Unaffected: 7.1.2-34 (semver) cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119124",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T15:41:24.642674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:42:35.371Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "7.1.2-34",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.2-34",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2-34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bewithyash"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:58:07.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x48p-6655-8qgv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x48p-6655-8qgv"
},
{
"name": "VulnCheck Advisory: ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-34-heap-buffer-overflow-via-morph-option"
}
],
"title": "ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119124",
"datePublished": "2026-10-29T15:58:07.508Z",
"dateReserved": "2026-10-29T14:25:14.746Z",
"dateUpdated": "2026-11-03T15:42:35.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Pre-design: Use a language or compiler that performs automatic bounds checking.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Strategy: Libraries or Frameworks
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Mitigation
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.