Alertas de Seguridad de la Información

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64739] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker may be able to cause unexpected app termination.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64725] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66041] FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability…

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data excee…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45813] Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS serv…

Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-16870] Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allo…

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by uploading a file with a crafted encryption metadata field to a shared internal stage that a victim proces…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

23/07/2026

[CVE-2026-16807] Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to …

Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65705] FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill v…

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processe…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65706] FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect vi…

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65703] FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video dec…

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65704] FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause he…

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64835] FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX au…

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses t…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-40691] In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine…

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', w…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

21/07/2026

[CVE-2026-16413] Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who …

Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

Z Alto vulnerabilidad

21/07/2026

[CVE-2026-10678] The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes …

The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive bu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-59146] Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unv…

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot. The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and foll…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15903] Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacke…

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63794] In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in …

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write usi…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53380] In the Linux kernel, the following vulnerability has been resolved: media: rzv2h-ivc: Fix concurren…

In the Linux kernel, the following vulnerability has been resolved: media: rzv2h-ivc: Fix concurrent buffer list access The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a spinlock (`rzv2h_ivc::buffers.lock`). However, in `rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the `list_del()` call is executed without holding the spinlock, which makes it possible for th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16095] A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the f…

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation of the argument ct_tcp_timeout can lead to out-of-bounds write. The attack may be performed from remote. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-45784] rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80…

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attac…

nvdaltovulnerabilidad CVSS 7.1 NVD