Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15567] A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2…

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15561] A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and cou…

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en gopacket permite denegación de servicio remota en aplicaciones Go

gopacket versión 1.7.0 y anteriores contiene múltiples decodificadores de capas que procesan longitudes, conteos u offsets controlados por el atacante sin validar contra los búferes de paquetes, permitiendo panic remoto. Aplicaciones que utilizan DecodingLayerParser o DecodeFromBytes en infraestructuras de análisis de tráfico, cortafuegos o sistemas de detección de intrusiones en LATAM son susceptibles a denegación de servicio remota.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70632] FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerabi…

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-67288] FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request d…

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en FreeRDP: desbordamiento de búfer en decodificador TSMF FFmpeg

FreeRDP anterior a versión 3.29.0 contiene una vulnerabilidad de lectura fuera de los límites de memoria en el decodificador TSMF FFmpeg al procesar tipos de medios AVC1 MPEG2VIDEOINFO con datos insuficientes. Un atacante puede enviar datos de formato multimedia malformados desde un servidor RDP para causar un fallo del cliente. Esta vulnerabilidad afecta directamente a entornos de escritorio remoto y soluciones de virtualización ampliamente utilizadas en empresas LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66040] FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in …

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66039] FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in t…

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_fra…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-58586] Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does…

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the mo…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65703] FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video dec…

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65918] PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul…

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64832] FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware d…

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame descripti…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64835] FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX au…

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses t…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

22/07/2026

[CVE-2026-64831] FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC …

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-48029] libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a he…

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

nvdaltovulnerabilidad CVSS 7.1 NVD

N Crítico vulnerabilidad

21/07/2026

[CVE-2026-56817] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity h…

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-55851] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROX…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-56745] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messag…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

21/07/2026

[CVE-2026-47247] libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib…

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat AS…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-55831] Netty is a network application framework for development of protocol servers and clients. Prior to 4…

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS f…

nvdaltovulnerabilidad CVSS 7.5 NVD