Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/07/2026

[CVE-2026-66034] libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that …

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16002] The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash th…

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65918] PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul…

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-43820] NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSS…

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13077] A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out…

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is u…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64833] FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer …

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF r…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-48029] libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a he…

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

nvdaltovulnerabilidad CVSS 7.1 NVD

Z Alto vulnerabilidad

21/07/2026

[CVE-2026-10680] The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/…

The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a co…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-59146] Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unv…

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot. The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and foll…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46600] Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the messa…

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15903] Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacke…

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

H Alto vulnerabilidad

20/07/2026

[CVE-2026-26197] HDF5 is a high-performance library and a file format specification that implements the HDF5 data mod…

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63807] In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage i…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63796] In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group b…

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can r…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63799] In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clear_bit …

In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path In mm_cid_fixup_cpus_to_tasks(), when rq->curr has the target mm and mm_cid.active is set, the CID is checked with cid_in_transit() before setting the transition bit. In per-CPU mode a newly forked or exec'd task can be running with mm_cid.cid == MM_CID_UNSET…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53402] In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds…

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the `err_out` label to roll back the console state. However, the current rollback logic forgets to restore the `hi_font` stat…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53390] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read i…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences the…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-57077] YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan i…

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-62351] TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, sour…

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causing an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server cra…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-10673] The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reasse…

The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and th…

nvdaltovulnerabilidad CVSS 8.3 NVD