Common Weakness Enumeration
CWE-122
AllowedHeap-based Buffer Overflow
Abstraction: Variant · Status: Draft
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
3349 vulnerabilities reference this CWE, most recent first.
CVE-2026-112280 (GCVE-0-2026-112280)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:34
VLAI
EPSS
VEX
Title
libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body
Summary
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:36 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/aribb24-caption-data-… | third-party-advisory |
| https://github.com/nkoriyama/aribb24/blob/v1.0.3/… | technical-description |
| https://www.vulncheck.com/advisories/libaribb24-a… | third-party-advisory |
Date Public
2026-10-17 17:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112280",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:36:04.630749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:34:41.023Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/nkoriyama/aribb24",
"defaultStatus": "unaffected",
"product": "aribb24",
"repo": "https://github.com/nkoriyama/aribb24",
"vendor": "nkoriyama",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T17:52:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:25.644Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/aribb24-caption-data-unit-and-csi-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/nkoriyama/aribb24/blob/v1.0.3/src/parser.c"
},
{
"name": "VulnCheck Advisory: libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libaribb24-aribb24-through-1.0.3-heap-buffer-overflow-via-parse-data-unit-statement-body"
}
],
"title": "libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112280",
"datePublished": "2026-10-19T13:55:25.644Z",
"dateReserved": "2026-10-19T13:25:30.552Z",
"dateUpdated": "2026-10-19T16:34:41.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112109 (GCVE-0-2026-112109)
Vulnerability from cvelistv5 – Published: 2026-11-05 17:20 – Updated: 2026-11-05 20:12
VLAI
EPSS
VEX
Title
Local privilege escalation in SafeNet Authentication Client SACSrv
Summary
A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:12 UTC
Assigner
THA-PSIRT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Safenet Authentication Client Service |
Affected:
0 , ≤ 10.9.7449
(custom)
cpe:2.3:a:thalesgroup:safenet_authentication_client_service:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-112109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:12:41.015658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:12:51.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Safenet Authentication Client Service",
"vendor": "Thalesgroup",
"versions": [
{
"lessThanOrEqual": "10.9.7449",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_service:*:*:windows:*:*:*:*:*",
"versionEndIncluding": "10.9.7449",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Carliez (david.carliez.consulting@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,\u0026nbsp;non-administrator local user to trigger a heap-based buffer overflow through the service interface.\u0026nbsp;Successful exploitation may allow arbitrary code execution with Local System privileges.\u003cdiv\u003eThis issue affects SAC releases up to and including 10.9 R3\u0026nbsp;GA (build 10.9.7449).\u003c/div\u003e"
}
],
"value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,\u00a0non-administrator local user to trigger a heap-based buffer overflow through the service interface.\u00a0Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3\u00a0GA (build 10.9.7449)."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:20:32.829Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=89d3c2ce2b105350cdc1f87df291bf55\u0026sysparm_article=KB0031248"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.\u003c/p\u003e"
}
],
"value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Local privilege escalation in SafeNet Authentication Client SACSrv",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-112109",
"datePublished": "2026-11-05T17:20:32.829Z",
"dateReserved": "2026-10-18T20:48:22.182Z",
"dateUpdated": "2026-11-05T20:12:51.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112021 (GCVE-0-2026-112021)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-19 16:05
VLAI
EPSS
VEX
Title
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
Summary
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:04 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://nullenvk.pl/posts/02-snac2-json | technical-description |
| https://gist.github.com/nullenvk/2bf288e2d34cb3d4… | exploit |
| https://codeberg.org/grunfink/snac2/src/tag/2.92/… | technical-description |
| https://codeberg.org/grunfink/snac2/commit/ec2c5c… | patch |
| https://codeberg.org/grunfink/snac2/releases/tag/2.93 | release-notes |
| https://codeberg.org/grunfink/snac2 | product |
| https://www.vulncheck.com/advisories/snac2-before… | third-party-advisory |
Date Public
2026-07-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112021",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:04:19.806894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:05:15.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snac2",
"repo": "https://codeberg.org/grunfink/snac2",
"vendor": "grunfink",
"versions": [
{
"lessThan": "2.93",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "nullenvk"
}
],
"datePublic": "2026-07-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:40.652Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://nullenvk.pl/posts/02-snac2-json"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b"
},
{
"tags": [
"technical-description"
],
"url": "https://codeberg.org/grunfink/snac2/src/tag/2.92/xs_json.h#L283-L285"
},
{
"tags": [
"patch"
],
"url": "https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7"
},
{
"tags": [
"release-notes"
],
"url": "https://codeberg.org/grunfink/snac2/releases/tag/2.93"
},
{
"tags": [
"product"
],
"url": "https://codeberg.org/grunfink/snac2"
},
{
"name": "VulnCheck Advisory: snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer"
}
],
"title": "snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112021",
"datePublished": "2026-10-18T11:38:40.652Z",
"dateReserved": "2026-10-18T01:24:56.329Z",
"dateUpdated": "2026-10-19T16:05:15.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111458 (GCVE-0-2026-111458)
Vulnerability from cvelistv5 – Published: 2026-10-16 05:24 – Updated: 2026-10-16 12:30
VLAI
EPSS
VEX
Title
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
Summary
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-16 05:20 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 12:30 UTC
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/adulau/ssldump/commit/8ad55683… | patch |
Impacted products
GCVE extensions
AI-generated
Partially reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-16 05:20 - Model
qwen3.8:27b- Input
-
https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
454d108335b2… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
8ad55683cc01
|
Fix heap overflow in FAN/1 X.509 fingerprint formatting | 454d108335b2… |
Fix summary
The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.
Patch summary
In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.
CVSS rationale
AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.
Weakness rationale
- CWE-122 The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation.
- CWE-787 The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category.
Attack pattern rationale
- CAPEC-109 CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog.
Assumptions to verify
- The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.
- The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).
- The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.
- The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.
- No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.
- The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 11 | medium | 6 |
- 2026-10-16 04:32 UTC Fix developed Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111458",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T12:30:41.664327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:30:53.251Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl/sslxprint.c (fanx_fingerprint)"
],
"product": "ssldump",
"programFiles": [
"ssl/sslxprint.c"
],
"repo": "https://github.com/adulau/ssldump",
"vendor": "adulau",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
},
{
"lang": "en",
"type": "finder",
"value": "https://github.com/TristanInSec"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.\u003c/p\u003e"
}
],
"value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."
}
],
"impacts": [
{
"capecId": "CAPEC-109",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-109 Buffer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T05:26:55.129Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.\u003c/p\u003e"
}
],
"value": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.",
"The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).",
"The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.",
"The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.",
"No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.",
"The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file."
],
"capecRationale": [
{
"capecId": "CAPEC-109",
"rationale": "CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog."
}
],
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
}
],
"cvssRationale": "AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.",
"fixSummary": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.",
"generatedAt": "2026-10-16T05:20:29.596478Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"patchSummary": "In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.",
"patchTruncated": false,
"patches": [
{
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"date": "Fri, 16 Oct 2026 04:32:38 +0000",
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"sourceUrl": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting"
}
],
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"weaknessRationale": [
{
"cweId": "CWE-122",
"rationale": "The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation."
},
{
"cweId": "CWE-787",
"rationale": "The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch"
],
"timestamp": "2026-10-16T04:32:38Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20308"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-111458",
"datePublished": "2026-10-16T05:24:43.178Z",
"dateReserved": "2026-10-16T05:24:32.520Z",
"dateUpdated": "2026-10-16T12:30:53.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111441 (GCVE-0-2026-111441)
Vulnerability from cvelistv5 – Published: 2026-10-19 02:31 – Updated: 2026-10-19 17:42
VLAI
EPSS
VEX
Title
HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
Summary
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:42 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
openGauss
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| openGauss-server | openGauss-server |
Unaffected:
7.0.0-LTS
|
|
| openGauss-server | openGauss-server |
Affected:
7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3
Affected: 2.1.0 Affected: 3.0.0-3.0.6 Affected: 3.1.0 Affected: 5.0.0-5.0.5 Affected: 6.0.0-6.0.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:42:18.566832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:42:42.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0%20(LTS)",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "unaffected",
"version": "7.0.0-LTS"
}
]
},
{
"collectionURL": "https://opengauss.org/zh/download/archive/?version=7.0.0-RC3",
"defaultStatus": "unaffected",
"platforms": [
"openEuler Centos"
],
"product": "openGauss-server",
"vendor": "openGauss-server",
"versions": [
{
"status": "affected",
"version": "7.0.0-RC1, 7.0.0-RC2 7.0.0-RC3"
},
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "3.0.0-3.0.6"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "5.0.0-5.0.5"
},
{
"status": "affected",
"version": "6.0.0-6.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal \u0026gt;= lenUsed\uff0c\u4e5f\u5c06 memcpy_s() \u76ee\u6807\u5927\u5c0f\u5199\u6210 lenUsed \u800c\u975e\u5b9e\u9645\u5206\u914d\u7684 lenTotal\uff0c\u5bfc\u81f4\u5b89\u5168\u62f7\u8d1d\u65e0\u6cd5\u62e6\u622a\u8d8a\u754c\u5199\u3002hll_in()\u3001hll_print()\u3001hll_cardinality() \u7b49 SQL \u5165\u53e3\u4f1a\u8d70\u540c\u4e00\u89e3\u5305\u8def\u5f84\u3002\u56e0\u6b64\uff0c\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u7528\u6237\u53ea\u9700\u6784\u9020 lenTotal \u5c0f\u4e8e lenUsed \u7684\u7578\u5f62 packed HLL\uff08\u4f8b\u5982\u7ecf ::hll \u8fdb\u5165 hll_in()\uff09\uff0c\u5373\u53ef\u89e6\u53d1\u670d\u52a1\u7aef\u5806\u8d8a\u754c\u5199\uff0c\u5b58\u5728\u5185\u5b58\u7834\u574f\u98ce\u9669\u3002\u6b64\u95ee\u9898\u968f packed HLL \u89e3\u5305\u51fd\u6570 HllObjectUnpack() \u8fdb\u5165\u4ee3\u7801\uff0cv2.1.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 2.1.0\u30013.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u5728 HllObjectUnpack() \u4e2d\u8865\u9f50 lenUsed \u0026lt;= lenTotal \u6821\u9a8c\uff0c\u5e76\u5c06 memcpy_s() \u7684\u76ee\u6807\u5927\u5c0f\u6539\u4e3a\u5b9e\u9645\u5206\u914d\u7684 lenTotal\u3002\u4fee\u590d PR \u89c1 https://gitcode.com/opengauss/openGauss-server/pull/9380 \u3002\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \u4e2d\uff0c\u5185\u7f6e\u51fd\u6570 HllObjectUnpack() \u5b58\u5728\u957f\u5ea6\u6821\u9a8c\u7f3a\u9677\u3002\u8be5\u51fd\u6570\u4ece\u7528\u6237\u63d0\u4f9b\u7684 packed HLL \u89e3\u6790 lenUsed \u4e0e lenTotal \u540e\uff0c\u4ec5\u68c0\u67e5\u8f93\u5165\u957f\u5ea6\u8db3\u4ee5\u8986\u76d6 HLL_HEAD_SIZE + lenUsed\uff0c\u968f\u540e\u6309 lenTotal \u5206\u914d\u7f13\u51b2\u533a\u3001\u6309 lenUsed \u8c03\u7528 memcpy_s() \u62f7\u8d1d\u8f93\u5165\uff0c\u65e2\u672a\u6821\u9a8c lenTotal \u003e= lenUsed\uff0c\u4e5f\u5c06 memcpy_s() \u76ee\u6807\u5927\u5c0f\u5199\u6210 lenUsed \u800c\u975e\u5b9e\u9645\u5206\u914d\u7684 lenTotal\uff0c\u5bfc\u81f4\u5b89\u5168\u62f7\u8d1d\u65e0\u6cd5\u62e6\u622a\u8d8a\u754c\u5199\u3002hll_in()\u3001hll_print()\u3001hll_cardinality() \u7b49 SQL \u5165\u53e3\u4f1a\u8d70\u540c\u4e00\u89e3\u5305\u8def\u5f84\u3002\u56e0\u6b64\uff0c\u666e\u901a\u6570\u636e\u5e93\u8fde\u63a5\u7528\u6237\u53ea\u9700\u6784\u9020 lenTotal \u5c0f\u4e8e lenUsed \u7684\u7578\u5f62 packed HLL\uff08\u4f8b\u5982\u7ecf ::hll \u8fdb\u5165 hll_in()\uff09\uff0c\u5373\u53ef\u89e6\u53d1\u670d\u52a1\u7aef\u5806\u8d8a\u754c\u5199\uff0c\u5b58\u5728\u5185\u5b58\u7834\u574f\u98ce\u9669\u3002\u6b64\u95ee\u9898\u968f packed HLL \u89e3\u5305\u51fd\u6570 HllObjectUnpack() \u8fdb\u5165\u4ee3\u7801\uff0cv2.1.0 \u8d77\u5373\u5b58\u5728\u3002\u53d7\u5f71\u54cd\u7248\u672c\u5305\u62ec 2.1.0\u30013.0.x\u30013.1.x\u30015.0.x\u30015.1.0\u30016.0.x\uff0c\u4ee5\u53ca 7.0.0-RC1\u30017.0.0-RC2\u30017.0.0-RC3\u3002\u8be5\u95ee\u9898\u5df2\u5728 7.0.0-LTS \u7248\u672c\u4fee\u590d\uff0c\u901a\u8fc7\u5728 HllObjectUnpack() \u4e2d\u8865\u9f50 lenUsed \u003c= lenTotal \u6821\u9a8c\uff0c\u5e76\u5c06 memcpy_s() \u7684\u76ee\u6807\u5927\u5c0f\u6539\u4e3a\u5b9e\u9645\u5206\u914d\u7684 lenTotal\u3002\u4fee\u590d PR \u89c1 https://gitcode.com/opengauss/openGauss-server/pull/9380 \u3002"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T02:31:01.069Z",
"orgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"shortName": "openGauss"
},
"references": [
{
"url": "https://gitcode.com/opengauss/openGauss-server/pull/9380"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HLL \u53cd\u5e8f\u5217\u5316 lenTotal/lenUsed \u6821\u9a8c\u7f3a\u5931\u5bfc\u81f4\u5806\u8d8a\u754c\u5199",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a1a479f7-907b-4ae8-a999-9148cadc9224",
"assignerShortName": "openGauss",
"cveId": "CVE-2026-111441",
"datePublished": "2026-10-19T02:31:01.069Z",
"dateReserved": "2026-10-16T03:04:58.958Z",
"dateUpdated": "2026-10-19T17:42:42.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111381 (GCVE-0-2026-111381)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-28 19:04
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser
Summary
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 13:56 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T13:56:34.542741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T13:56:54.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Lidi Jie, School of Cyber Science and Engineering, Wuhan University"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:04:03.455Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-26cc-wjh8-hjw6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-v2-parser"
}
],
"title": "FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111381",
"datePublished": "2026-10-16T01:17:50.516Z",
"dateReserved": "2026-10-15T21:54:36.054Z",
"dateUpdated": "2026-10-28T19:04:03.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111379 (GCVE-0-2026-111379)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-28 19:04
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
Summary
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 17:44 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://github.com/programmervuln/freerdp-persist… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111379",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T17:44:00.030060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:55:39.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lidi Jie, School of Cyber Science and Engineering, Wuhan University"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:04:34.300Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-945c-qq5h-jqwp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp"
},
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3"
}
],
"title": "FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111379",
"datePublished": "2026-10-16T01:17:47.354Z",
"dateReserved": "2026-10-15T21:54:36.054Z",
"dateUpdated": "2026-10-28T19:04:34.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111183 (GCVE-0-2026-111183)
Vulnerability from cvelistv5 – Published: 2026-10-21 17:15 – Updated: 2026-10-23 11:06
VLAI
EPSS
VEX
Title
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
Summary
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 23:04 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
zdi
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
| https://gitlab.freedesktop.org/gstreamer/gstreame… | vendor-advisory |
Impacted products
Date Public
2026-10-15 20:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111183",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T23:04:53.997381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T11:06:23.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "GStreamer",
"vendor": "GStreamer",
"versions": [
{
"status": "affected",
"version": "5903987091bb25e4f549331032cd2e3494cf8dae"
}
]
}
],
"dateAssigned": "2026-10-15T17:43:26.740Z",
"datePublic": "2026-10-15T20:34:06.544Z",
"descriptions": [
{
"lang": "en",
"value": "GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T17:15:23.195Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-26-775",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-775/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory"
],
"url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/80c184b4c5ee8ba28b2540ba58f40b8d44b61622"
}
],
"source": {
"lang": "en",
"value": "Anonymous"
},
"title": "GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2026-111183",
"datePublished": "2026-10-21T17:15:23.195Z",
"dateReserved": "2026-10-15T17:43:26.712Z",
"dateUpdated": "2026-10-23T11:06:23.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110958 (GCVE-0-2026-110958)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:30 – Updated: 2026-10-15 18:34
VLAI
EPSS
VEX
Title
Wavlink WN530HG4B api.cgi heap-based overflow
Summary
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:34 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/420571 | vdb-entry |
| https://vuldb.com/vuln/420571/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-110958 | third-party-advisory |
| https://vuldb.com/submit/933388 | third-party-advisory |
| https://drive.google.com/file/d/12OOh8g9YDCbD-Q4c… | exploit |
| https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLI… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110958",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:34:10.216285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:34:20.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wn530hg4b:*:*:*:*:*:*:*:*"
],
"product": "WN530HG4B",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M30HG4B_V260724"
},
{
"status": "unaffected",
"version": "2026-09-24-841a51c6d5_tclinux.bin"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aissac (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info\u0026client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:30:18.031Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-420571 | Wavlink WN530HG4B api.cgi heap-based overflow",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/420571"
},
{
"name": "VDB-420571 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/420571/cti"
},
{
"name": "CVE-2026-110958 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-110958"
},
{
"name": "Submit #933388 | Wavlink WN530HG4B M30HG4B_V260724 Heap-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933388"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/12OOh8g9YDCbD-Q4cc52J6TH9KuOoD44A/view?usp=drive_link"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-15T11:36:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WN530HG4B api.cgi heap-based overflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-110958",
"datePublished": "2026-10-15T15:30:18.031Z",
"dateReserved": "2026-10-15T09:30:59.165Z",
"dateUpdated": "2026-10-15T18:34:20.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110837 (GCVE-0-2026-110837)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 13:47
VLAI
EPSS
VEX
Title
FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding
Summary
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:46 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-2.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110837",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:46:25.348471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:47:43.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "finder",
"value": "skigeek16"
},
{
"lang": "en",
"type": "finder",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:12.464Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-52xc-5973-w5vv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv"
},
{
"name": "VulnCheck Advisory: FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding"
}
],
"title": "FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110837",
"datePublished": "2026-10-14T22:52:12.464Z",
"dateReserved": "2026-10-14T22:11:15.575Z",
"dateUpdated": "2026-10-15T13:47:43.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Pre-design: Use a language or compiler that performs automatic bounds checking.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Strategy: Libraries or Frameworks
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
Mitigation
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
CAPEC-92: Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.