Common Weakness Enumeration
CWE-787
Allowed-with-ReviewOut-of-bounds Write
Abstraction: Base · Status: Draft
The product writes data past the end, or before the beginning, of the intended buffer.
3475 vulnerabilities reference this CWE, most recent first.
CVE-2026-111497 (GCVE-0-2026-111497)
Vulnerability from cvelistv5 – Published: 2026-10-22 13:35 – Updated: 2026-11-06 15:39
VLAI
EPSS
VEX
Title
Out-of-Bounds Write in Google Brotli Decoder
Summary
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 00:00 UTC
Assigner
Google
CNA
References
22 references
Impacted products
24 products
| Vendor | Product | Version | |
|---|---|---|---|
| Brotli |
Affected:
1.0.3 , < 1.0.10
(semver)
Affected: 1.1.0 , < 1.1.1 (semver) Affected: 1.2.0 , < 1.2.1 (semver) |
||
| Siemens | Cloud Connector Configurator |
Affected:
0 , < V1.24.3
(custom)
|
|
| Siemens | Common Configurator (CC on IEM) |
Affected:
0 , < *
(custom)
|
|
| Siemens | Common Configurator on Device (CC on Edge) |
Affected:
0 , < *
(custom)
|
|
| Siemens | Data Flow Monitoring |
Affected:
0 , < V3.0.18
(custom)
|
|
| Siemens | Databus Configurator |
Affected:
0 , < V4.0.1
(custom)
|
|
| Siemens | DataXess Configurator |
Affected:
0 , < V1.5.7
(custom)
|
|
| Siemens | Desigo CC family V8 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC family V9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Edge OPC UA Server Configurator |
Affected:
0 , < V2.3.10
(custom)
|
|
| Siemens | Flow Creator Configurator |
Affected:
0 , < V1.15.1
(custom)
|
|
| Siemens | Gridscale X DSA |
Affected:
V5.3 , < V5.4
(custom)
|
|
| Siemens | Gridscale X PSS®E |
Affected:
0 , < V36.8.0
(custom)
|
|
| Siemens | Heliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Industrial Edge Hub |
Affected:
0 , < *
(custom)
|
|
| Siemens | Industrial Edge Management Cloud |
Affected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCharge AC Series |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloud |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
Date Public
2026-02-27 07:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111497",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:48.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-11-03T21:05:46.791Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/25"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/24/6"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/26/12"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/26/13"
},
{
"url": "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"
},
{
"url": "https://broccoli2shell.com"
},
{
"url": "https://github.com/dotnet/announcements/issues/494"
},
{
"url": "https://github.com/google/brotli/releases/tag/v1.2.1"
},
{
"url": "https://github.com/google/brotli/releases/tag/v1.1.1"
},
{
"url": "https://github.com/google/brotli/releases/tag/v1.0.10"
},
{
"url": "https://patchtheplanet.org/brotli"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/26/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/03/2"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "Cloud Connector Configurator",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.24.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Common Configurator\u00a0(CC on IEM)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Common Configurator on Device\u00a0(CC on Edge)",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Data Flow Monitoring",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.0.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Databus Configurator",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DataXess Configurator",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.5.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC family V8",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC family V9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Edge OPC UA Server Configurator",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V2.3.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Flow Creator Configurator",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Gridscale X DSA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.4",
"status": "affected",
"version": "V5.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Gridscale X PSS\u00aeE",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V36.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Cloud",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCharge AC Series",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloud",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:39:57.176Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-898633.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-443410.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-045512.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/google/brotli",
"product": "Brotli",
"repo": "https://github.com/google/brotli",
"vendor": "Google",
"versions": [
{
"lessThan": "1.0.10",
"status": "affected",
"version": "1.0.3",
"versionType": "semver"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
},
{
"lessThan": "1.2.1",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OpenAI Codex Security - Khai Tran and Sylvie Mayer"
}
],
"datePublic": "2026-02-27T07:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA buffer overflow vulnerability in the Brotli decoder (\u003ccode\u003ec/dec/decode.c\u003c/code\u003e) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252 Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T14:58:42.704Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
},
{
"tags": [
"release-notes",
"third-party-advisory"
],
"url": "https://github.com/andybalholm/brotli/releases/tag/v1.2.7"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
}
],
"value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Out-of-Bounds Write in Google Brotli Decoder",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2026-111497",
"datePublished": "2026-10-22T13:35:41.975Z",
"dateReserved": "2026-10-16T09:58:17.790Z",
"dateUpdated": "2026-11-06T15:39:57.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111487 (GCVE-0-2026-111487)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:21 – Updated: 2026-11-06 16:24
VLAI
EPSS
VEX
Title
Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework
Summary
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:24 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
Qt
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_… | vendor-advisory |
| https://codereview.qt-project.org/c/qt%2Fqt3d/+/777981 | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| qt | Qt Framework |
Affected:
6.5.0 , < 6.8.10
(python)
Affected: 6.9.0 , < 6.11.3 (python) Affected: 6.12.0 , < 6.12.1 (python) cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* cpe:2.3:a:qt:qt3d:*:*:*:*:*:*:*:* |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111487",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:24:04.512129Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:24:18.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qt3d:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"qt3d"
],
"product": "Qt Framework",
"vendor": "qt",
"versions": [
{
"lessThan": "6.8.10",
"status": "affected",
"version": "6.5.0",
"versionType": "python"
},
{
"lessThan": "6.11.3",
"status": "affected",
"version": "6.9.0",
"versionType": "python"
},
{
"lessThan": "6.12.1",
"status": "affected",
"version": "6.12.0",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bruno Fournier"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module."
}
],
"value": "An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:21:23.428Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt"
},
"references": [
{
"name": "Qt Wiki: List of known vulnerabilities in Qt products",
"tags": [
"vendor-advisory"
],
"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-111487"
},
{
"name": "Qt3D patch (dev)",
"tags": [
"patch"
],
"url": "https://codereview.qt-project.org/c/qt%2Fqt3d/+/777981"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "Qt",
"cveId": "CVE-2026-111487",
"datePublished": "2026-10-30T14:21:23.428Z",
"dateReserved": "2026-10-16T09:43:55.645Z",
"dateUpdated": "2026-11-06T16:24:18.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111458 (GCVE-0-2026-111458)
Vulnerability from cvelistv5 – Published: 2026-10-16 05:24 – Updated: 2026-10-16 12:30
VLAI
EPSS
VEX
Title
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
Summary
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-16 05:20 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 12:30 UTC
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/adulau/ssldump/commit/8ad55683… | patch |
Impacted products
GCVE extensions
AI-generated
Partially reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-16 05:20 - Model
qwen3.8:27b- Input
-
https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
454d108335b2… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
8ad55683cc01
|
Fix heap overflow in FAN/1 X.509 fingerprint formatting | 454d108335b2… |
Fix summary
The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.
Patch summary
In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.
CVSS rationale
AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.
Weakness rationale
- CWE-122 The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation.
- CWE-787 The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category.
Attack pattern rationale
- CAPEC-109 CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog.
Assumptions to verify
- The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.
- The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).
- The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.
- The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.
- No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.
- The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 11 | medium | 6 |
- 2026-10-16 04:32 UTC Fix developed Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111458",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T12:30:41.664327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:30:53.251Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl/sslxprint.c (fanx_fingerprint)"
],
"product": "ssldump",
"programFiles": [
"ssl/sslxprint.c"
],
"repo": "https://github.com/adulau/ssldump",
"vendor": "adulau",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
},
{
"lang": "en",
"type": "finder",
"value": "https://github.com/TristanInSec"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.\u003c/p\u003e"
}
],
"value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."
}
],
"impacts": [
{
"capecId": "CAPEC-109",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-109 Buffer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T05:26:55.129Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.\u003c/p\u003e"
}
],
"value": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.",
"The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).",
"The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.",
"The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.",
"No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.",
"The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file."
],
"capecRationale": [
{
"capecId": "CAPEC-109",
"rationale": "CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog."
}
],
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
}
],
"cvssRationale": "AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.",
"fixSummary": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.",
"generatedAt": "2026-10-16T05:20:29.596478Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"patchSummary": "In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.",
"patchTruncated": false,
"patches": [
{
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"date": "Fri, 16 Oct 2026 04:32:38 +0000",
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"sourceUrl": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting"
}
],
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"weaknessRationale": [
{
"cweId": "CWE-122",
"rationale": "The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation."
},
{
"cweId": "CWE-787",
"rationale": "The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch"
],
"timestamp": "2026-10-16T04:32:38Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20308"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-111458",
"datePublished": "2026-10-16T05:24:43.178Z",
"dateReserved": "2026-10-16T05:24:32.520Z",
"dateUpdated": "2026-10-16T12:30:53.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111382 (GCVE-0-2026-111382)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 17:07
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine
Summary
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:48 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:48:54.978727Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:07:31.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:51.334Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f4pf-pgp4-f2r3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-out-of-bounds-write-in-avc444-yuv444-combine"
}
],
"title": "FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111382",
"datePublished": "2026-10-16T01:17:51.334Z",
"dateReserved": "2026-10-15T21:54:36.054Z",
"dateUpdated": "2026-10-16T17:07:31.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111280 (GCVE-0-2026-111280)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-29 16:55
VLAI
EPSS
VEX
Title
snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
Summary
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 19:55 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/davenardella/snap7/issues/31 | issue-tracking |
| https://github.com/davenardella/snap7/blob/30f37d… | technical-description |
| https://github.com/davenardella/snap7 | product |
| https://www.vulncheck.com/advisories/snap7-throug… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davenardella | snap7 |
Affected:
0 , ≤ 1.4.3
(custom)
cpe:2.3:a:snap7_project:snap7:*:*:*:*:*:*:*:* |
Date Public
2026-08-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111280",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T19:55:46.274712Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T19:56:20.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/davenardella/snap7/issues/31"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/davenardella/snap7",
"product": "snap7",
"repo": "https://github.com/davenardella/snap7",
"vendor": "davenardella",
"versions": [
{
"lessThanOrEqual": "1.4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snap7_project:snap7:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.3",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mayur Agnihotri (Mayur021)"
},
{
"lang": "en",
"type": "finder",
"value": "Shukhratbek Uraiimov"
}
],
"datePublic": "2026-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:55:58.134Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/davenardella/snap7/issues/31"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/davenardella/snap7/blob/30f37da3114024a71ba93f7fd855c680b97a406f/src/core/s7_micro_client.cpp#L136-L150"
},
{
"tags": [
"product"
],
"url": "https://github.com/davenardella/snap7"
},
{
"name": "VulnCheck Advisory: snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snap7-through-1.4.3-out-of-bounds-write-via-tsnap7microclient-opreadarea"
}
],
"title": "snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111280",
"datePublished": "2026-10-15T21:43:24.650Z",
"dateReserved": "2026-10-15T19:56:08.790Z",
"dateUpdated": "2026-10-29T16:55:58.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111275 (GCVE-0-2026-111275)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-21 01:37
VLAI
EPSS
VEX
Title
nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
Summary
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:37 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob | technical-description |
| https://github.com/NIFTI-Imaging/nifti_clib/issues/195 | issue-tracking |
| https://github.com/NIFTI-Imaging/nifti_clib/pull/197 | issue-trackingpatch |
| https://github.com/NIFTI-Imaging/nifti_clib/blob/… | technical-description |
| https://github.com/NIFTI-Imaging/nifti_clib | product |
| https://www.vulncheck.com/advisories/nifti-clib-t… | third-party-advisory |
| https://hackmd.io/@haind-pwn/cve-2026-111275-nift… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NIFTI-Imaging | nifti_clib |
Affected:
0 , ≤ 3.0.1
(semver)
|
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111275",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:37:15.716658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:37:40.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/cve-2026-111275-nifticlib-nifti2-dim0-oob"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/NIFTI-Imaging/nifti_clib",
"product": "nifti_clib",
"repo": "https://github.com/NIFTI-Imaging/nifti_clib",
"vendor": "NIFTI-Imaging",
"versions": [
{
"lessThanOrEqual": "3.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "s1ko"
},
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:21.786Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/NIFTI-Imaging/nifti_clib/issues/195"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/NIFTI-Imaging/nifti_clib/pull/197"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026"
},
{
"tags": [
"product"
],
"url": "https://github.com/NIFTI-Imaging/nifti_clib"
},
{
"name": "VulnCheck Advisory: nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim"
}
],
"title": "nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111275",
"datePublished": "2026-10-15T21:43:21.786Z",
"dateReserved": "2026-10-15T19:33:21.431Z",
"dateUpdated": "2026-10-21T01:37:40.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111270 (GCVE-0-2026-111270)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-21 01:33
VLAI
EPSS
VEX
Title
libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
Summary
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:33 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libmodplug-dsm-patte… | technical-description |
| https://github.com/Konstanty/libmodplug/blob/d1b9… | technical-description |
| https://github.com/Konstanty/libmodplug | product |
| https://www.vulncheck.com/advisories/libmodplug-t… | third-party-advisory |
| https://hackmd.io/@haind-pwn/cve-2026-111270-1112… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Konstanty Bialkowski | libmodplug |
Affected:
0 , ≤ 0.8.9.1
(custom)
cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111270",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:33:14.344247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:33:42.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/cve-2026-111270-111271-libmodplug-dsm-pattern-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Konstanty/libmodplug",
"product": "libmodplug",
"repo": "https://github.com/Konstanty/libmodplug",
"vendor": "Konstanty Bialkowski",
"versions": [
{
"lessThanOrEqual": "0.8.9.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.8.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:17.665Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/libmodplug-dsm-pattern-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Konstanty/libmodplug/blob/d1b97ed0020bc620a059d3675d1854b40bd2608d/src/load_dsm.cpp#L130-L139"
},
{
"tags": [
"product"
],
"url": "https://github.com/Konstanty/libmodplug"
},
{
"name": "VulnCheck Advisory: libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libmodplug-through-0.8.9.1-heap-out-of-bounds-write-via-csoundfile-readdsm"
}
],
"title": "libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111270",
"datePublished": "2026-10-15T21:43:17.665Z",
"dateReserved": "2026-10-15T19:33:19.371Z",
"dateUpdated": "2026-10-21T01:33:42.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111161 (GCVE-0-2026-111161)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:33
VLAI
EPSS
VEX
Title
libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates
Summary
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:32 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libadlmidi-notestate… | technical-description |
| https://github.com/Wohlstand/libADLMIDI/blob/99c5… | technical-description |
| https://github.com/Wohlstand/libADLMIDI/blob/99c5… | technical-description |
| https://github.com/Wohlstand/libADLMIDI | product |
| https://www.vulncheck.com/advisories/libadlmidi-1… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wohlstand | libADLMIDI |
Affected:
1.6.2 , ≤ 1.6.2.1
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111161",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:32:53.654457Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:33:17.206Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libadlmidi-notestates-note-index-stack-oob"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"product": "libADLMIDI",
"repo": "https://github.com/Wohlstand/libADLMIDI",
"vendor": "Wohlstand",
"versions": [
{
"lessThanOrEqual": "1.6.2.1",
"status": "affected",
"version": "1.6.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:49.073Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@haind-pwn/libadlmidi-notestates-note-index-stack-oob"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wohlstand/libADLMIDI/blob/99c5e03a5cf9b4fdf35b53efddb853c96320d50f/src/midiseq/impl/read_smf_impl.hpp#L113"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Wohlstand/libADLMIDI/blob/99c5e03a5cf9b4fdf35b53efddb853c96320d50f/src/midiseq/impl/miditrack_impl.hpp#L350-L357"
},
{
"tags": [
"product"
],
"url": "https://github.com/Wohlstand/libADLMIDI"
},
{
"name": "VulnCheck Advisory: libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libadlmidi-1.6.2-through-1.6.2.1-stack-out-of-bounds-write-via-bw-midisequencer-notestates"
}
],
"title": "libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111161",
"datePublished": "2026-10-15T18:57:49.073Z",
"dateReserved": "2026-10-15T17:04:03.762Z",
"dateUpdated": "2026-10-15T19:33:17.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111157 (GCVE-0-2026-111157)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-16 17:10
VLAI
EPSS
VEX
Title
SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding
Summary
SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:28 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/sox-wav-ms-adpcm-sam… | technical-descriptionexploit |
| https://github.com/chirlu/sox/blob/42b3557e13e0fe… | technical-description |
| https://github.com/chirlu/sox/blob/42b3557e13e0fe… | technical-description |
| https://sourceforge.net/projects/sox/ | product |
| https://www.vulncheck.com/advisories/sox-through-… | third-party-advisory |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111157",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:28:13.719712Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:10:07.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sourceforge.net/projects/sox/",
"defaultStatus": "unaffected",
"product": "sox",
"repo": "https://github.com/chirlu/sox",
"vendor": "SoX",
"versions": [
{
"lessThanOrEqual": "14.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt()."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:46.205Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/sox-wav-ms-adpcm-samplesperblock-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chirlu/sox/blob/42b3557e13e0fe01a83465b672d89faddbe65f49/src/adpcm.c#L144-L166"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chirlu/sox/blob/42b3557e13e0fe01a83465b672d89faddbe65f49/src/wav.c#L250-L251"
},
{
"tags": [
"product"
],
"url": "https://sourceforge.net/projects/sox/"
},
{
"name": "VulnCheck Advisory: SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sox-through-14.4.2-heap-out-of-bounds-write-via-ms-adpcm-wav-decoding"
}
],
"title": "SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111157",
"datePublished": "2026-10-15T18:57:46.205Z",
"dateReserved": "2026-10-15T17:04:02.354Z",
"dateUpdated": "2026-10-16T17:10:07.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111156 (GCVE-0-2026-111156)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:35
VLAI
EPSS
VEX
Title
libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header
Summary
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:33 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind-pwn/libtimidity-soundfon… | technical-descriptionexploit |
| https://github.com/sezero/libtimidity/blob/a52adf… | technical-description |
| https://github.com/sezero/libtimidity | product |
| https://www.vulncheck.com/advisories/libtimidity-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sezero | libtimidity |
Affected:
0.2.8 , ≤ 0.2.8
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111156",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:33:39.933334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:35:40.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/sezero/libtimidity",
"defaultStatus": "unaffected",
"product": "libtimidity",
"repo": "https://github.com/sezero/libtimidity",
"vendor": "sezero",
"versions": [
{
"lessThanOrEqual": "0.2.8",
"status": "affected",
"version": "0.2.8",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:45.506Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@haind-pwn/libtimidity-soundfont-generator-oper-oob-write"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sezero/libtimidity/blob/a52adf6aee2635e2a16797213a089c2180e67757/src/sndfont.c#L199-L224"
},
{
"tags": [
"product"
],
"url": "https://github.com/sezero/libtimidity"
},
{
"name": "VulnCheck Advisory: libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libtimidity-through-0.2.8-out-of-bounds-access-via-soundfont-preset-header"
}
],
"title": "libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111156",
"datePublished": "2026-10-15T18:57:45.506Z",
"dateReserved": "2026-10-15T17:04:02.006Z",
"dateUpdated": "2026-10-15T19:35:40.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
- Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
- Consider adhering to the following rules when allocating and managing an application's memory:
- Double check that the buffer is as large as specified.
- When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
- Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
- If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation
Strategy: Environment Hardening
- Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
- For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
No CAPEC attack patterns related to this CWE.