Alertas de Seguridad de la Información

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-58662] Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrif…

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Alto vulnerabilidad

24/07/2026

[CVE-2026-66033] libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vul…

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/07/2026

[CVE-2026-66034] libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that …

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16002] The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash th…

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65918] PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul…

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-43820] NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSS…

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13077] A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out…

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is u…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64833] FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer …

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF r…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-48029] libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a he…

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

nvdaltovulnerabilidad CVSS 7.1 NVD

G Crítico vulnerabilidad

21/07/2026

[CVE-2026-16419] Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a …

Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

Z Alto vulnerabilidad

21/07/2026

[CVE-2026-10680] The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/…

The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a co…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59145] Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot,…

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find. The attach-time validator si_validate_header is thorough about the header and layout (magic, version, section offsets, total_size, count and arena_used) but does not validate the three arrays it then trusts. Every lookup in si_idx_find walks a triple indir…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-59146] Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unv…

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot. The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and foll…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59147] Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an …

Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time validator dsu_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. dsu_find walks and path-compresses parent[x] with x a raw file-stored index never bounded a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46600] Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the messa…

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59139] Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated ar…

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-time validator reqrep_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqrep_recv_locked does memcpy(copy_buf, req_arena + arena_off, len) with arena_o…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59140] Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated no…

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment withou…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59141] Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated no…

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked. The attach-time validator rdx_validate_header checks the header scalars and region layout against the file size, but does not validate the node records it then trusts. rdx_find_locked indexes nodes[cur].children[k] and reads each node's label_off and label_l…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59142] Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated a…

Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time validator shm_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shm_str_copy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

21/07/2026

[CVE-2026-64609] Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is…

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were …

nvdcriticovulnerabilidad CVSS 9.1 NVD