heap buffer overflow

CVE-2026-42533 is a newly disclosed NGINX heap buffer overflow that turns an otherwise ordinary configuration feature—the map directive with regular-expression matching—into a potentially serious availability and code-execution risk. The flaw is not triggered by every NGINX installation, nor is...

CVE-2026-58618 is a high-severity Microsoft Excel vulnerability that can let an attacker run code after a user opens or otherwise processes a malicious file locally. Despite Microsoft calling it a “Remote Code Execution Vulnerability,” its CVSS 3.1 vector begins with AV:L, meaning exploitation...

CVE-2026-48914 is a QEMU/KVM vulnerability disclosed in June 2026 in which malformed virtio-blk SCSI requests from a highly privileged guest can trigger a heap buffer overflow in the host QEMU process, potentially causing denial of service for the affected virtual machine workload. The bug is...

CVE-2026-12019 is a high-severity heap buffer overflow in Chrome’s Codecs component, disclosed by Chrome on June 11, 2026, affecting Google Chrome on Linux and ChromeOS before version 149.0.7827.115 and potentially enabling sandbox escape through a crafted HTML page. The vulnerability is not the...

Google’s CVE-2026-10929 was published on June 4, 2026, as a high-severity heap buffer overflow in Chrome’s ANGLE graphics layer on Android before version 149.0.7827.53, with a potential sandbox escape path after renderer compromise. The bug is not the kind of drive-by catastrophe that lets any...

CVE-2026-31789 is the kind of Microsoft vulnerability that immediately grabs attention because it combines two words security teams hate seeing together: heap buffer overflow. The flaw sits in hexadecimal conversion, a routine that sounds mundane but often lives close to parsing, formatting, and...

Microsoft has now published guidance for CVE-2026-5858, a critical heap buffer overflow in WebML affecting Google Chrome before version 147.0.7727.55. The flaw can be triggered by a crafted HTML page, which means a remote attacker could potentially achieve arbitrary code execution through...

A newly disclosed **heap buffer overflow in Chrome’s CSS engine** has put one of the browser’s most ubiquitous attack surfaces back under the microscope. The flaw, tracked as **CVE-2026-4442**, affects Google Chrome versions prior to **146.0.7680.153** and, according to Microsoft’s Security...

Chromium’s latest browser security issue underscores a familiar truth: the web remains one of the most dangerous places to process untrusted content, and even a single crafted HTML page can still trigger memory corruption in a modern engine. CVE-2026-4673 is a heap buffer overflow in WebAudio...