Microsoft Security Response Center

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding

Colord: Slow rejection of oversized malformed color strings

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

xmldom: Quadratic-memory consumption

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom: Quadratic-time attribute deduplication

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

wolfSSL CA-cache hit overrides callback

ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

erofs: cap LZMA stream pool size

KVM: s390: pci: Validate AIBV and AISB before pinning guest pages

can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

ALSA: hda/tas2781: Cancel async firmware request at unbind

usb: gadget: f_tcm: keep port count until LUN teardown completes

gtp: serialize PDP context updates

xfrm: espintcp: fix UAF during close

xfrm: drop ESP-in-TCP packets with no ingress device

crypto: sun8i-ce - Remove crypto_rng interface

crypto: sun8i-ss - Remove crypto_rng interface

crypto: qce - fix CCM AAD buffer underallocation

nfc: st21nfca: validate ATR_REQ length against the received frame

xfs: don't livelock in scrub on a circular unlinked list

ocfs2: fix missing metadata reservation for large xattrs

nilfs2: reject invalid block index in GC ioctl

nfc: digital: clamp SENSF_RES length to the destination buffer

nfc: fdp: bound the device-reported read length and fix an skb leak

nfc: microread: validate target discovery payload lengths

nfc: llcp: bound the connect_sn TLV walk to the skb

nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

nfc: llcp: reject PDUs shorter than the LLCP header

nfc: pn533: purge fragmented skbs during cleanup

nfc: nci: add data_len bound checks to activation parameter extractors

nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

nvmet-auth: zero the AUTH_RECEIVE response buffer

nvmet-fc: fix invalid free in LS IOD error path

HID: pidff: fix OOB write when hid->inputs is empty

HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

HID: nintendo: register input device after capabilities are set

HID: nintendo: stop device IO before hid_hw_stop on probe failure

HID: ft260: fix stack-use-after-return write in I2C read race

Missing Authorization in Elasticsearch Leading to Information Disclosure

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

domain-scoped PSL domain cookie

vlan: fix skb_under_panic and races when toggling HW VLAN offload

xhci: dbgtty: Fix unregister on tty_register_driver() failure

KVM: s390: vsie: zero stale crypto bits

io_uring: defer eventfd signaling when queued from a wakeup handler

HID: core: fix number/pointer type confusion on long items

PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

selinux: require every boolean value to be defined

selinux: reject an unclaimed class value in security_get_classes()

drm/amdgpu: Reject UVD message with invalid number of h265 refs

net: tap: fix wrong transport_header when sending VLAN-tagged frame

net/tls: Fail tls_sw_splice_read() after a failed async decrypt

dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA

ipvs: fix the checksum validations

mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

sctp: reject stale cookies with mismatched verification tags

drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

drm/vmwgfx: use check_add_overflow for shader size+offset bound