CVE-2009-1788

libsndfile VOC file heap based buffer overflow

Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.

CVSS 2.0 · 9.3 Critical EPSS 8.2% KEV · Not listed

Vendors

Mega-nerd Nullsoft

Products

Libsndfile Winamp

CVE-2009-0386

gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Composition Time To Sample (aka ctts) atom data

Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.

CVSS 2.0 · 9.3 Critical EPSS 7.1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Good Plug-ins Enterprise Linux

CVE-2008-5557

php: Heap-based buffer overflow in the mbstring extension via crafted string containing a HTML entity (arb code execution)

Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.

CVSS 2.0 · 10.0 Critical EPSS 7.4% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2008-3529

libxml2: long entity name heap buffer overflow

Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

CVSS 2.0 · 10.0 Critical EPSS 23.4% KEV · Not listed

Vendors

Apple Canonical Debian and 2 more

Products

Iphone Os Mac Os X Safari and 4 more

CVE-2008-3522

jasper: possible buffer overflow in jas_stream_printf()

Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed

Vendors

Jasper Project Redhat

Products

Jasper Enterprise Virtualization Rhev Manager

CVE-2008-3432

vim: heap buffer overflow in mch_expand_wildcards()

Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.

CVSS 2.0 · 6.8 Medium EPSS 8.6% KEV · Not listed

Vendors

Redhat Vim

Products

Enterprise Linux Vim

CVE-2008-2360

X.org Render extension AllocateGlyph() heap buffer overflow

Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow.

CVSS 2.0 · 9.0 Critical EPSS 3.2% KEV · Not listed

Vendors

Redhat X

Products

Enterprise Linux X11

CVE-2008-1423

vorbis: integer oveflow caused by huge codebooks

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.

CVSS 2.0 · 9.3 Critical EPSS 8.1% KEV · Not listed

Vendors

Redhat Xiph.org

Products

Enterprise Linux Linux Advanced Workstation Libvorbis

CVE-2007-4990

xfs heap overflow in the swap_char2b function

The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.

CVSS 2.0 · 7.5 High EPSS 10.7% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux X Font Server

CVE-2008-5824

audiofile: heap-based overflow in Microsoft ADPCM compression module (app crash, arb. code execution)

Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.

CVSS 2.0 · 6.8 Medium EPSS 6.0% KEV · Not listed

Vendors

68k

Products

Audiofile

CVE-2008-3916

ed: Heap-based buffer overflow (arb. code execution)

Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

CVSS 2.0 · 9.3 Critical EPSS 3.6% KEV · Not listed

Vendors

Gnu Redhat

Products

Ed Enterprise Linux

CVE-2008-0047

cups: heap based buffer overflow in cgiCompileSearch()

Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed

Vendors

Apple Cups Redhat

Products

Mac Os X Mac Os X Server Cups and 1 more

CVE-2009-1515

file: heap-based buffer overflow in cdf_read_sat()

Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 6.8 Medium EPSS 3.7% KEV · Not listed

Vendors

Christos Zoulas

Products

File

CVE-2009-4124

ruby: Heap-based buffer overflow in the rb_str_justify() function

Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 10.0 Critical EPSS 3.9% KEV · Not listed

Vendors

Ruby-lang

Products

Ruby

CVE-2009-0397

gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Time-to-sample (stss) atom data

Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka gstreamer-plugins) 0.8.5, might allow remote attackers to execute arbitrary code via crafted Time-to-sample (aka stts) atom data in a malformed QuickTime media .mov file.

CVSS 2.0 · 9.3 Critical EPSS 7.1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Good Plug-ins Plug-ins Enterprise Linux

CVE-2026-3994

rui314 mold Object File input-files.cc initialize_sections heap-based overflow

A vulnerability was detected in rui314 mold up to 2.40.4. This issue affects the function mold::ObjectFilemold::X86_64::initialize_sections of the file src/input-files.cc of the component Object File Handler. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Rui314

Products

Mold

CVE-2026-3713

pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow

A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libpng

Products

Libpng

CVE-2026-3407

YosysHQ yosys BLIF File rtlil.h set heap-based overflow

A vulnerability was determined in YosysHQ yosys up to 0.62. This affects the function Yosys::RTLIL::Const::set of the file kernel/rtlil.h of the component BLIF File Parser. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Applying a patch is the recommended action to fix this issue. It appears that the issue is not reproducible all the time.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Yosyshq

Products

Yosys

CVE-2026-40706

NTFS-3G SUID-root Heap Buffer Overflow Enables Privilege Escalation

In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Tuxera

Products

Ntfs-3g

CVE-2026-6491

libvips nip2 vips7compat.c im_minpos_vec heap-based overflow

A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libvips

Products

Libvips