CWE-787

In printf of printf.c, there is a possible out-of-bounds write due to improper input validation

In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0200High· 8.8

▾ Twilightgoogle · androidEPSS 0.29%via NVD

In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow

In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0199High· 7.8

▾ Twilightgoogle · androidEPSS 0.07%via NVD

In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation

In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not …

CVE-2026-55301High· 8.4

In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check

In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex…

CVE-2026-55323High· 7.8

In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds write due to a heap buffer overflow

In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…

CVE-2026-55332Medium· 6.7

In multiple locations, there is a possible out-of-bounds write due to improper input validation

In multiple locations, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55365Medium· 6.7

In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check

In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for expl…

CVE-2026-55351High· 7.8

In VPU, there is a possible out-of-bounds write due to an integer overflow

In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56920High· 8.8

▾ Twilightgoogle · androidEPSS 0.39%via NVD

In s_decode_vui_param of fw_hevc_dec_header.c, there is a possible out-of-bounds write due to a logic error in the code

In s_decode_vui_param of fw_hevc_dec_header.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not nee…

CVE-2026-56942High· 8.8

In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check

In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed…

CVE-2026-56945High· 7.8

▾ Twilightgoogle · androidEPSS 0.09%via NVD

In VPU, there is a possible out-of-bounds write due to a confused deputy

In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56972Medium· 6.7

In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check

In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56974High· 8.8

In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation

In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for…

CVE-2026-56989Medium· 6.7

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56997High· 8.8

In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check

In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not n…

CVE-2026-57035Medium· 6.7

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check

CVE-2026-57014High· 7.8

In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check

In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User i…

CVE-2026-58701High· 7.0

▾ Twilightgoogle · androidEPSS 0.07%via NVD

In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition

In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for expl…

CVE-2026-58683High· 8.8

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-11728High· 8.1

▾ TwilightIBM · MQEPSS 0.35%via NVD

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a …

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a …

CVE-2026-11928Critical· 9.8

▾ MidnightIBM · Verify Identity AccessEPSS 0.29%via NVD

IBM Verify Identity Access is vulnerable to a buffer overflow attack.

CVE-2026-91951Medium· 6.5PoC

▾ Twilightfreerdp · freerdpEPSS 0.38%via NVD

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trig…

CVE-2026-91958Medium· 6.6PoC

▾ Twilightfreerdp · freerdpEPSS 0.16%via NVD

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an out-of-range selectedmon…

CVE-2026-91962Medium· 6.3

▾ Sunlitfreerdp · freerdpEPSS 0.26%via NVD

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer s…

CVE-2026-90439Medium· 6.5

▾ SunlitF5 · NGINX PlusEPSS 0.43%via NVD

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a…

CVE-2026-92007High· 8.8

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16…

CVE-2026-92013High· 8.8

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

CVE-2026-92008High· 8.8

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

CVE-2026-92011High· 8.8

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component