Haind

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI read node header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI stridx c to scan past disk node data, crashing tools like cgnslist.

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif init frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip points(), causing an out-of-bounds raster read in draw line() during sft render() and crashing the process.

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221 lib.c, whose bit reader refills without checking the data u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode vector quantized mlt indices() past the stack buffer during format detection, crashing the application.

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute() bounds checks, crashing applications or leaking adjacent heap memory into attribute values.

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main sheet get sheetfile expat callback element start() in lib/xlsxio read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread sheet open() is called.

LASzip through 3.5.0 contains an invalid free vulnerability in laszip read header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi decode with every slot set to DRCS MODE 6 5 4, causing convert drcs to overflow chars[48][60] and crash the application.

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg multipart parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.

ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation section accessor get entry() that allows attackers to crash applications via an unvalidated sh link index. Attackers can supply a crafted ELF file whose SHT REL or SHT RELA section has a dangling sh link, causing find hash section() to dereference null and deny service.

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFS utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS utf8stricmp() and hashing to over-read and crash the application.

quirc through 1.2 contains an excessive-iteration vulnerability in find alignment pattern() in lib/identify.c that allows attackers to hang quirc end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.

Libyal libpff through 20260926 contains an integer underflow in libpff record entry get multi value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT MV STRING8, PT MV UNICODE or PT MV BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory.

L-SMASH through 2.14.5 contains a double free vulnerability in hevc setup first summary() and h264 setup first summary() in importer/nalu imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash read file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2 decode file all info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2 stat or smb2 fstat calls, crashing the client.