Heap Buffer Overflow Archives • Daily CyberSecurity

Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

Ghostscript vulnerability CVE-2026-39919 enabling remote code execution through uploaded PDF files

Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

Do Son October 12, 2026

A critical Ghostscript vulnerability, CVE-2026-39919 (CVSS 9.8), allows remote code execution via crafted PDFs. Update Ghostscript to 10.08.0 now.

CVE-2026-14669: PoC Code Enables RCE in PostgreSQL PostgreSQL vulnerability CVE-2026-14669 heap overflow to_char remote code execution proof-of-concept exploit

PostgreSQL vulnerability CVE-2026-14669 heap overflow to_char remote code execution proof-of-concept exploit

CVE-2026-14669: PoC Code Enables RCE in PostgreSQL

Do Son August 24, 2026

A PostgreSQL vulnerability (CVE-2026-14669, CVSS 8.8) with public PoC exploit code allows remote code execution via to_char. Update now.

libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory libssh2 vulnerabilities let a malicious SSH server corrupt heap memory in SSH and SFTP clients

libssh2 vulnerabilities let a malicious SSH server corrupt heap memory in SSH and SFTP clients

libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory

Do Son July 28, 2026

Four libssh2 vulnerabilities let a malicious SSH server corrupt memory in connecting clients. Update past version 1.11.1 to stay protected.

Public PoC Exploit Exposes CVE-2026-44421 FreeRDP Heap Buffer Overflow to Remote Code Execution FreeRDP heap buffer overflow vulnerability CVE-2026-44421 CVE-2026-44422 CVE-2026-40033 diagram

FreeRDP heap buffer overflow vulnerability CVE-2026-44421 CVE-2026-44422 CVE-2026-40033 diagram

Public PoC Exploit Exposes CVE-2026-44421 FreeRDP Heap Buffer Overflow to Remote Code Execution

Do Son July 22, 2026

FreeRDP heap buffer overflow allows remote code execution. PoC exploits are publicly disclosed. Related to CVE-2026-44421, CVE-2026-44422, CVE-2026-40033.

7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution Through Crafted XZ Data

7-Zip vulnerability CVE-2026-14266 XZ decompression heap buffer overflow remote code execution

7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution Through Crafted XZ Data

Do Son July 16, 2026

7-Zip vulnerability CVE-2026-14266 (CVSS 7.0) allows remote code execution via crafted XZ data. Update to 7-Zip 26.02. No exploitation confirmed.

CVE-2026-56000: Use-After-Free Flaw Hits X.Org Server and Xwayland X.Org Server use-after-free vulnerability CVE-2026-56000 patched in xorg-server 21.1.24

X.Org Server use-after-free vulnerability CVE-2026-56000 patched in xorg-server 21.1.24

CVE-2026-56000: Use-After-Free Flaw Hits X.Org Server and Xwayland

Do Son July 14, 2026

X.Org Server ships fixes for two flaws, including CVE-2026-56000, a CVSS 9.0 use-after-free. Update xorg-server and Xwayland now.

FreeSWITCH Heap Buffer Overflow Bugs Expose Servers to Pre-Auth Attacks

FreeSWITCH heap buffer overflow CVE-2026-49841, CVE-2026-49840, mod_verto vulnerability

FreeSWITCH Heap Buffer Overflow Bugs Expose Servers to Pre-Auth Attacks

Do Son June 16, 2026

Two pre-auth FreeSWITCH heap buffer overflow bugs (CVE-2026-49841, CVE-2026-49840) hit mod_verto and libesl. Update to v1.11.1 to stay safe.

New 7-Zip Heap Buffer Overflow Disclosed with Public PoC 7-Zip heap buffer overflow CVE-2025-0411 7-Zip path traversal

New 7-Zip Heap Buffer Overflow Disclosed with Public PoC

Do Son May 26, 2026

CVE-2026-48095 (CVSS 8.8) is a heap buffer overflow in 7-Zip that a crafted archive can trigger. Update to the patched version now.

Critical 9.2 CVSS: NGINX JavaScript Module Flaw (CVE-2026-8711) Triggers Heap Buffer Overflows NGINX JavaScript Module Vulnerability CVE-2026-8711 NGINX 1.30.1 Security Update CVE-2026-42945 RCE NGINX Vulnerability CVE-2026-1642 NGINX Github - CVE-2025-23419

NGINX JavaScript Module Vulnerability CVE-2026-8711 NGINX 1.30.1 Security Update CVE-2026-42945 RCE NGINX Vulnerability CVE-2026-1642 NGINX Github - CVE-2025-23419

Critical 9.2 CVSS: NGINX JavaScript Module Flaw (CVE-2026-8711) Triggers Heap Buffer Overflows

Do Son May 20, 2026

F5 warns of a critical 9.2 CVSS flaw (CVE-2026-8711) in NGINX JavaScript (njs). Unauthenticated attackers can trigger heap overflows and potential RCE.

NGINX Rift: Critical 18-Year-Old Flaw CVE-2026-42945 Actively Exploited to Crash Servers NGINX Rift CVE-2026-42945

NGINX Rift: Critical 18-Year-Old Flaw CVE-2026-42945 Actively Exploited to Crash Servers

Do Son May 19, 2026

Critical 18-year-old "NGINX Rift" flaw CVE-2026-42945 is under active exploitation. Learn how to patch your proxies and block the unauthenticated heap overflow.

PoC Exploit Publicly Disclosed: 20-Year-Old PostgreSQL pgcrypto Flaw (CVE-2026-2005) Grants Full Superuser RCE PostgreSQL pgcrypto PoC Exploit CVE-2026-2005 Public Disclosure

PostgreSQL pgcrypto PoC Exploit CVE-2026-2005 Public Disclosure

PoC Exploit Publicly Disclosed: 20-Year-Old PostgreSQL pgcrypto Flaw (CVE-2026-2005) Grants Full Superuser RCE

Do Son May 19, 2026

Technical details and GitHub PoC exploits disclosed for PostgreSQL pgcrypto CVE-2026-2005. Low-privilege users can seize root superuser RCE. Patch now!

Critical 18-Year-Old NGINX RCE (CVE-2026-42945) and GitHub PoC Disclosed NGINX RCE Vulnerability CVE-2026-42945 PoC

Critical 18-Year-Old NGINX RCE (CVE-2026-42945) and GitHub PoC Disclosed

Do Son May 14, 2026

Public PoC for NGINX CVE-2026-42945. An 18-year-old RCE flaw in the rewrite module enables server takeover. Update to NGINX 1.31.0 or 1.30.1 immediately.

Chrome 147 Update: Google Patches Critical $90,000 ANGLE Flaw and 30 Other Security Gaps Chrome Security Update $90K Bug Bounty

Chrome 147 Update: Google Patches Critical $90,000 ANGLE Flaw and 30 Other Security Gaps

Do Son April 16, 2026

Google patches 31 Chrome flaws, including a $90K graphics engine bug. Update to version 147.0.7727.101 now to block critical sandbox escapes and RCE risks.

Critical—9 Vulnerabilities in Orthanc DICOM Servers Threaten Medical Data Integrity CVE-2025-2263 Orthanc Security DICOM Vulnerabilities

Critical—9 Vulnerabilities in Orthanc DICOM Servers Threaten Medical Data Integrity

Do Son April 14, 2026

Orthanc v1.12.11 patches 9 critical flaws, including RCE risks and "decompression bombs" in DICOM servers. Secure your healthcare data—upgrade now!

The $86,000 Patch: Chrome 147 Crushes “Critical” WebML Memory Flaws Chrome 147 Security WebML Vulnerabilities

The $86,000 Patch: Chrome 147 Crushes “Critical” WebML Memory Flaws

Do Son April 9, 2026

Google Chrome 147 is out with critical security fixes for WebML and V8. Protect your browser from overflows and memory leaks—update to version 147 now!

Chrome 146 Arrives with 29 Security Fixes: Critical WebML Flaw Discovered Chrome 146 Security CVE-2026-3913

Chrome 146 Arrives with 29 Security Fixes: Critical WebML Flaw Discovered

Do Son March 12, 2026

Google releases Chrome 146, fixing 29 vulnerabilities including a critical heap buffer overflow in WebML (CVE-2026-3913). Update your browser immediately.

Urgent Chrome Patch: Google Fixes High-Severity PDF and V8 Engine Flaws

Chrome Security Update Use After Free Chrome Security Update Critical Vulnerabilities Chrome Security Update CVE-2026-3062 Chrome Security Update V8 Engine Vulnerability Chrome Security Update CVE-2026-1862 CVE-2026-0628 Chrome 143 Update Chrome Safe Browsing UAF, CVE-2025-11756 Chrome Memory Flaws, CVE-2025-11460 Google Chrome, vulnerability CVE-2025-10200, CVE-2025-10201 Big Sleep CVE-2025-9478 Chrome Update, Security Vulnerabilities

Urgent Chrome Patch: Google Fixes High-Severity PDF and V8 Engine Flaws

Do Son February 19, 2026

Google releases an urgent Chrome update to patch high-severity flaws in PDFium (CVE-2026-2648) and the V8 engine (CVE-2026-2649). Update to 145 now.

30-Year-Old Bug: High-Severity libpng Flaw (CVSS 8.3) Exposes Millions of Apps libpng Vulnerability CVE-2026-25646 libpng Vulnerability Remote Code Execution (RCE)

libpng Vulnerability CVE-2026-25646 libpng Vulnerability Remote Code Execution (RCE)

30-Year-Old Bug: High-Severity libpng Flaw (CVSS 8.3) Exposes Millions of Apps

Do Son February 10, 2026

A 30-year-old heap overflow in libpng (CVE-2026-25646) exposes apps to DoS & RCE. The flaw affects all versions since inception. Update to v1.6.55 now.

Chrome 144 Security Alert: V8 & Libvpx Flaws Expose Systems to Hacks

Do Son February 4, 2026

Google Chrome patches high-severity V8 (CVE-2026-1862) and libvpx (CVE-2026-1861) flaws. Update to version 144.0.7559.132 immediately.

ImageMagick Alert (CVE-2026-23876): “XBM” Image Uploads Trigger Massive Heap Overflow ImageMagick Vulnerability CVE-2026-23876 ImageMagick TIM Overflow, Memory Disclosure Flaw ImageMagick vulnerabilities, memory corruption CVE-2023-34152

ImageMagick Alert (CVE-2026-23876): “XBM” Image Uploads Trigger Massive Heap Overflow

Do Son January 21, 2026

High-severity ImageMagick flaw CVE-2026-23876 allows heap buffer overflows via XBM images. Update to v7.1.2-13 to prevent remote attacks.

Exim’s Poisoned Record: How a Failed Patch and SQL Injection Lead to Critical Heap Overflows CVE-2025-26794 Exim SQL Injection, Heap Buffer Overflow

CVE-2025-26794 Exim SQL Injection, Heap Buffer Overflow

Exim’s Poisoned Record: How a Failed Patch and SQL Injection Lead to Critical Heap Overflows

Do Son December 22, 2025

NIST warns of a critical Exim 4.99 flaw. A failed SQLi patch allows attackers to poison SQLite records and trigger a 1.5MB heap buffer overflow.

Critical strongSwan Heap Overflow in EAP-MSCHAPv2 Plugin Allows Remote Code Execution CVE-2025-62291 strongSwan Heap Overflow

Critical strongSwan Heap Overflow in EAP-MSCHAPv2 Plugin Allows Remote Code Execution

Do Son October 29, 2025

A Critical Heap Overflow in strongSwan's EAP-MSCHAPv2 plugin allows Remote Code Execution on the client. An integer underflow in Failure Request packet processing causes memory corruption.