Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52956] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len r…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52942] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52927] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB re…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu says: The function compat_mtw_from_user() converts ebtables extensions from 32-bit user structures to kernel native structures. However, it lacks proper validation of the user-supplied match_size/target_size. When certain extensions are processed, the kern…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52917] In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associ…

In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dump_one path The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk), and then resume after sctp_association_free() has marked the association dead and freed its bind address list. When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill()…

nvdaltovulnerabilidad CVSS 7.1 NVD

Z Alto vulnerabilidad

23/06/2026

[CVE-2026-10658] bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timest…

bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-48502] MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader…

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is valid…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2026-9265] Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8…

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent hea…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56210] A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementatio…

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can inf…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/06/2026

[CVE-2026-52910] In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog a…

In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed by sk_reuseport_prog_free(). bpf_prog_put() i…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

19/06/2026

[CVE-2026-48138] There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bo…

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2025-62821] Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDat…

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.

nvdcriticovulnerabilidad CVSS 9.1 NVD

R Crítico vulnerabilidad

17/06/2026

[CVE-2026-3894] Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffer…

Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.0.0 before 5.2.*.

nvdcriticovulnerabilidad CVSS 9.1 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-30802] Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This …

Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0, from 2.4.5 before 2.4.*.

nvdaltovulnerabilidad CVSS 8.2 NVD

G Alto vulnerabilidad

16/06/2026

[CVE-2026-0135] In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to r…

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

16/06/2026

[CVE-2026-0131] In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. Thi…

In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12314] Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140…

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12310] Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140…

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12087] Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_s…

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-53703] A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a R…

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without fi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-53704] A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a…

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from…

nvdaltovulnerabilidad CVSS 7.1 NVD