Alertas de Seguridad de la Información

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-67191] Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that…

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-16463] A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflo…

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48372] Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitr…

Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-55971] Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache T…

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66040] FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in …

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66036] FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in …

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66039] FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in t…

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_fra…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/07/2026

[CVE-2026-66035] libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow …

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56165] Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over…

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-49035] The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate reques…

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13072] When compute mode is enabled on a standalone mongod instance, insufficient validation of externally …

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

nvdaltovulnerabilidad CVSS 8.1 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64830] FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtit…

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded wri…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-40691] In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine…

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-61390] There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthentic…

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.

nvdaltovulnerabilidad CVSS 7.7 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-44178] xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vu…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sen…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Crítico vulnerabilidad

20/07/2026

[CVE-2026-41252] xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp,…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Alto vulnerabilidad

20/07/2026

[CVE-2026-63090] ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_s…

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Crítico vulnerabilidad

20/07/2026

[CVE-2026-64620] FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common…

FreeRDP before 3.28.0 (affected

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Alto vulnerabilidad

18/07/2026

[CVE-2026-53994] ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The …

ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-11826] OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_…

OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interfa…

nvdaltovulnerabilidad CVSS 8.8 NVD