Radar
A personal hobby project. Radar aggregates security advisories from CISA, Zero Day Initiative and CERT-EU and adds short editorial highlights on what I find notable from a European infrastructure perspective — not a threat-intel service, not exhaustive, just what catches my eye.
-
ZDI-26-253: Microsoft Visual Studio Code mcp.json Command Injection Remote Code Execution Vulnerability
The vulnerability requires a user to open a malicious project to trigger command injection via mcp.json in Visual Studio Code.
Read more → -
ZDI-26-250: Linux Kernel Analog Device Driver Improper Validation of Array Index Local Privilege Escalation Vulnerability
This vulnerability requires local execution with high privileges to exploit. The advisory specifies a CVSS score of 8.2.
Read more → -
ZDI-26-227: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
The vulnerability requires authentication to exploit and could lead to information disclosure via path traversal in OpenClaw.
Read more → -
ZDI-26-228: OpenClaw Canvas Authentication Bypass Vulnerability
The advisory notes that authentication is not required to exploit the vulnerability, indicating potential for unauthenticated remote access.
Read more → -
ZDI-26-229: OpenClaw Client PKCE Verifier Information Disclosure Vulnerability
The vulnerability requires user interaction during an OAuth authorization flow to disclose stored credentials.
Read more → -
ZDI-26-230: Apple macOS CoreMedia Framework Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability is an out-of-bounds write in the CoreMedia framework requiring user interaction for remote code execution.
Read more → -
ZDI-26-231: Apple macOS Exposure of Sensitive Information to Unauthorized Sphere Information Disclosure Vulnerability
The vulnerability requires a local attacker with low-privileged code execution to disclose sensitive information. It affects Apple macOS installations with a CVSS rating of 3.8.
Read more → -
ZDI-26-232: (Pwn2Own) Red Hat Enterprise Linux vmwgfx Driver Integer Overflow Local Privilege Escalation Vulnerability
The vulnerability is an integer overflow in the vmwgfx driver, which is part of the Red Hat Enterprise Linux kernel graphics subsystem.
Read more → -
ZDI-26-233: Digilent DASYLab DSA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
The vulnerability is triggered by parsing a malicious DSA file, leading to an out-of-bounds read in Digilent DASYLab.
Read more → -
ZDI-26-234: Digilent DASYLab DSA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
The vulnerability requires user interaction through opening a malicious file or visiting a malicious page. A CVSS score of 7.8 is assigned.
Read more → -
ZDI-26-235: Digilent DASYLab DSA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability involves an out-of-bounds write during DSA file parsing in Digilent DASYLab, requiring user interaction for exploitation.
Read more → -
ZDI-26-236: Digilent DASYLab DSB File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
DASYLab DSB file parsing contains an out-of-bounds write vulnerability. Exploitation requires user interaction via a malicious file or page.
Read more → -
ZDI-26-237: (Pwn2Own) QNAP QHora-322 ip6_wanifset Improper Restriction of Communication Channel to Intended Endpoints Firewall Bypass Vulnerability
The advisory notes a firewall bypass vulnerability in the QNAP QHora-322 router due to improper restriction of a communication channel.
Read more → -
ZDI-26-238: Linux Kernel AoE Driver Use-After-Free Local Privilege Escalation Vulnerability
The vulnerability is a use-after-free in the Linux Kernel AoE driver that can be exploited by local attackers to escalate privileges.
Read more → -
ZDI-26-239: (Pwn2Own) QNAP QHora-322 login.newAuthMiddleware.Authenticator Authentication Bypass Vulnerability
The vulnerability enables remote authentication bypass on QNAP QHora-322 routers without requiring prior authentication.
Read more → -
ZDI-26-240: (Pwn2Own) QNAP QHora-322 qvpn_db_mgr role_type Improper Neutralization of Escape Sequences Authentication Bypass Vulnerability
The advisory notes that authentication is required to exploit the vulnerability, yet the authentication mechanism can be bypassed, which may indicate a flaw in how role_type input is validated during the authentication process.
Read more → -
ZDI-26-241: (Pwn2Own) QNAP QHora-322 qvpn_db_mgr username SQL Injection Remote Code Execution Vulnerability
The vulnerability involves a SQL injection in the qvpn_db_mgr component that can be exploited remotely after bypassing authentication.
Read more → -
ZDI-26-242: (Pwn2Own) QNAP TS-453E server_handlers.pyc rr2s.kwargs Error Message Information Disclosure Vulnerability
The vulnerability involves an information disclosure in the server_handlers.pyc rr2s.kwargs component of QNAP TS-453E devices, where authentication can be bypassed despite being nominally required.
Read more → -
ZDI-26-243: (Pwn2Own) QNAP TS-453E write_file_to_svr External Control of File Path Remote Code Execution Vulnerability
The vulnerability affects QNAP TS-453E devices and involves external control of a file path via the write_file_to_svr function, potentially allowing remote code execution.
Read more → -
ZDI-26-244: (Pwn2Own) QNAP QHora-322 miro_webserver_controllers_api_login_singIn Authentication Bypass Vulnerability
The vulnerability enables network-adjacent attackers to bypass authentication on QNAP QHora-322 routers without requiring credentials.
Read more → -
ZDI-26-246: (0Day) aws-mcp-server Command Injection Remote Code Execution Vulnerability
The vulnerability permits unauthenticated remote code execution with a CVSS score of 9.8. The assigned CVE is CVE-2026-5058.
Read more → -
ZDI-26-247: NoMachine External Control of File Path Arbitrary File Deletion Vulnerability
The vulnerability requires local code execution for exploitation. The advisory assigns a CVSS score of 7.1.
Read more → -
ZDI-26-248: NoMachine External Control of File Path Local Privilege Escalation Vulnerability
The vulnerability involves external control of file paths in NoMachine, potentially allowing local privilege escalation.
Read more → -
ZDI-26-249: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
The vulnerability stems from an uncontrolled search path element in NoMachine, which could allow local privilege escalation if exploited.
Read more → -
ZDI-26-226: (0Day) Microsoft Azure MCP AzureCliService Command Injection Remote Code Execution Vulnerability
The vulnerability allows unauthenticated remote code execution in Microsoft Azure MCP AzureCliService with a CVSS rating of 9.8.
Read more → -
ZDI-26-222: (Pwn2Own) Canon imageCLASS MF654Cdw BJNP Memory Corruption Remote Code Execution Vulnerability
The vulnerability allows network-adjacent attackers to achieve remote code execution without authentication on Canon MF654Cdw printers.
Read more → -
ZDI-26-223: (Pwn2Own) Samsung Galaxy S25 Smart Touch Call Application Protection Mechanism Failure Information Disclosure Vulnerability
The vulnerability requires user interaction, such as visiting a malicious page or opening a malicious file, to disclose sensitive information on the Samsung Galaxy S25.
Read more → -
ZDI-26-224: (Pwn2Own) Samsung Galaxy S25 Samsung Account Cross-Site Scripting Remote Code Execution Vulnerability
The vulnerability affects Samsung Galaxy S25 devices and involves a cross-site scripting issue that can lead to remote code execution without authentication.
Read more → -
ZDI-26-225: (Pwn2Own) Samsung Galaxy S25 Samsung Account Open Redirect Security Bypass Vulnerability
The vulnerability involves a Samsung Account open redirect that enables security bypass on Samsung Galaxy S25 devices.
Read more → -
ZDI-26-217: GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability
The vulnerability stems from an integer overflow during PSD file parsing in GIMP, which can lead to remote code execution if a malicious file is opened.
Read more → -
ZDI-26-218: GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability
The vulnerability stems from an integer overflow during ANI file parsing in GIMP, which can lead to remote code execution if a user opens a malicious file.
Read more → -
ZDI-26-219: GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is triggered by parsing a malicious JP2 file in GIMP, requiring user interaction to open the file or visit a malicious page.
Read more → -
ZDI-26-220: GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is triggered by parsing a malicious PSP file, requiring user interaction to open the file or visit a malicious page.
Read more → -
ZDI-26-221: GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability
The vulnerability stems from an integer overflow during XPM file parsing in GIMP, which can lead to remote code execution if a user opens a malicious file.
Read more → -
ZDI-26-216: (Pwn2Own) QNAP TS-453E smbd domain_name Argument Injection Authentication Bypass Vulnerability
The vulnerability enables authentication bypass on QNAP TS-453E devices via argument injection in the smbd domain_name field, requiring no credentials.
Read more → -
ZDI-26-187: (Pwn2Own) Synology DiskStation Manager Netatalk Library Buffer Overflow Remote Code Execution Vulnerability
The vulnerability affects Synology DiskStation Manager's Netatalk library and permits remote code execution without authentication.
Read more → -
ZDI-26-188: (Pwn2Own) VMware ESXi VMCI Integer Underflow Local Privilege Escalation Vulnerability
The vulnerability is a local privilege escalation in VMware ESXi's VMCI component, requiring high-privileged code execution in a guest VM as a prerequisite.
Read more → -
ZDI-26-189: (Pwn2Own) VMware ESXi VMXNET3 Integer Overflow Local Privilege Escalation Vulnerability
The vulnerability requires prior high-privileged code execution on the guest to escalate privileges within the VMware ESXi hypervisor.
Read more → -
ZDI-26-190: (Pwn2Own) VMware Workstation PVSCSI Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
The vulnerability is a heap-based buffer overflow in VMware Workstation's PVSCSI component, requiring an attacker to already execute high-privileged code within the guest system.
Read more → -
ZDI-26-191: (Pwn2Own) Linux Kernel nf_tables Use-After-Free Privilege Escalation Vulnerability
The vulnerability is a use-after-free in nf_tables that could allow local privilege escalation.
Read more → -
ZDI-26-192: Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability
The vulnerability allows unauthenticated remote code execution with a CVSS score of 10.0. The Sonos Era 300 appears to expose an SMB service network-facing.
Read more → -
ZDI-26-193: (Pwn2Own) Linux Kernel nf_tables_newset Out-Of-Bounds Write Information Disclosure Vulnerability
The vulnerability requires local access and low-privileged code execution to exploit. It involves an out-of-bounds write in the nf_tables_newset component.
Read more → -
ZDI-26-194: Microsoft Exchange InterceptorSmtpAgent Improper Input Validation Security Feature Bypass Vulnerability
The vulnerability affects Microsoft Exchange's InterceptorSmtpAgent and stems from improper input validation, enabling remote security feature bypass without authentication.
Read more → -
ZDI-26-195: (Pwn2Own) ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability
The vulnerability allows unauthorized remote disclosure of sensitive information from ChargePoint Home Flex charging stations without authentication.
Read more → -
ZDI-26-196: (Pwn2Own) ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is a stack-based buffer overflow in the OCPP getpreq function, exploitable by network-adjacent attackers without authentication.
Read more → -
ZDI-26-197: (Pwn2Own) ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability
Network-adjacent attackers can achieve unauthenticated remote code execution on ChargePoint Home Flex devices. This vulnerability was demonstrated during the Pwn2Own 2026 competition.
Read more → -
ZDI-26-198: (Pwn2Own) QNAP TS-453E malware_remover Code Injection Remote Code Execution Vulnerability
Network-adjacent attackers can execute arbitrary code without authentication on QNAP TS-453E devices. The malware_remover component is vulnerable to code injection.
Read more → -
ZDI-26-199: (Pwn2Own) QNAP TS-453E conn_log_tool Format String Remote Code Execution Vulnerability
The vulnerability allows bypassing authentication on QNAP TS-453E devices. Network-adjacent attackers can achieve remote code execution.
Read more → -
ZDI-26-200: (Pwn2Own) QNAP TS-453E nvrlog_event_add msg SQL Injection Remote Code Execution Vulnerability
The vulnerability requires network adjacency but allows bypass of authentication. The ZDI assigned a CVSS score of 8.0.
Read more → -
ZDI-26-201: (Pwn2Own) QNAP TS-453E Hyper Data Protector Plugin Hard-Coded Credentials Authentication Bypass Vulnerability
The advisory notes a hard-coded credentials vulnerability in the QNAP TS-453E Hyper Data Protector plugin that allows authentication bypass without requiring user interaction.
Read more → -
ZDI-26-202: (Pwn2Own) QNAP TS-453E Hyper Data Protector Plugin query_original_file_size SQL Injection Remote Code Execution Vulnerability
The advisory notes that authentication is required but can be bypassed, which may indicate a flaw in the access control implementation for the Hyper Data Protector Plugin.
Read more → -
ZDI-26-203: (Pwn2Own) Canon imageCLASS MF654Cdw XML SOAP Request Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability affects Canon imageCLASS MF654Cdw printers and involves a heap-based buffer overflow in XML SOAP request parsing.
Read more → -
ZDI-26-204: (Pwn2Own) Canon imageCLASS MF654Cdw XPS Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability affects the XPS parser in Canon imageCLASS MF654Cdw printers and can be exploited remotely without authentication.
Read more → -
ZDI-26-205: (Pwn2Own) Canon imageCLASS MF654Cdw PJCC Request Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
This is a network-adjacent RCE vulnerability in a Canon printer requiring no authentication. It was demonstrated at Pwn2Own 2026.
Read more → -
ZDI-26-206: (Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability requires no authentication and allows network-adjacent attackers to execute arbitrary code via a TTF parsing flaw.
Read more → -
ZDI-26-207: (Pwn2Own) Canon imageCLASS MF654Cdw dtdc_addr_importSub Stack-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability allows unauthenticated, network-adjacent attackers to achieve remote code execution on affected Canon printers.
Read more → -
ZDI-26-208: (Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability affects Canon imageCLASS MF654Cdw printers and requires no authentication for exploitation.
Read more → -
ZDI-26-209: (Pwn2Own) Samsung Galaxy S25 Samsung Members Open Redirect Security Bypass Vulnerability
The advisory describes an open redirect vulnerability in Samsung Galaxy S25's Samsung Members component. The vulnerability allows bypassing security controls without requiring authentication.
Read more → -
ZDI-26-210: (Pwn2Own) Samsung Galaxy S25 Samsung Members Security Feature Bypass Vulnerability
The vulnerability enables remote security feature bypass on the Samsung Galaxy S25 without requiring authentication.
Read more → -
ZDI-26-211: Delta Electronics ASDA-Soft PAR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
A stack-based buffer overflow exists in Delta Electronics ASDA-Soft's PAR file parsing. Exploitation requires user interaction through a malicious file or page.
Read more → -
ZDI-26-212: Schneider Electric EcoStruxure Data Center Expert Hard-coded Password Remote Code Execution Vulnerability
The advisory notes a hard-coded password vulnerability in Schneider Electric EcoStruxure Data Center Expert that allows remote code execution with authenticated access.
Read more → -
ZDI-26-213: GIMP LBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is triggered by parsing a malicious LBM file, leading to a heap-based buffer overflow.
Read more → -
ZDI-26-214: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is triggered by parsing malicious HDR files, leading to a heap-based buffer overflow in GIMP.
Read more → -
ZDI-26-215: KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
The vulnerability stems from an uncontrolled search path element in KeePassXC's OpenSSL configuration, potentially allowing local privilege escalation.
Read more → -
ZDI-26-173: Apple macOS Audio APAC Frame Decoding Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability involves an out-of-bounds write in the APAC frame decoding process within Apple macOS, potentially enabling remote code execution.
Read more → -
ZDI-26-174: Apple macOS ImageIO SGI File Parsing Integer Overflow Remote Code Execution Vulnerability
An integer overflow exists in Apple macOS ImageIO during SGI file parsing. The vulnerability requires interaction with the ImageIO library but specific attack vectors are not detailed.
Read more → -
ZDI-26-175: Apple macOS ImageIO SGI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
The vulnerability requires interaction with macOS's ImageIO framework to exploit, but specific attack vectors depend on implementation.
Read more → -
ZDI-26-176: Apple macOS libusd_ms Alembic File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability involves an out-of-bounds write in libusd_ms during Alembic file parsing, requiring user interaction to trigger via a malicious file.
Read more → -
ZDI-26-177: Array Networks MotionPro ArrayInstallManager Incorrect Permission Assignment Local Privilege Escalation Vulnerability
MotionPro ArrayInstallManager has a local privilege escalation vulnerability requiring initial low-privileged code execution.
Read more → -
ZDI-26-178: Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability
The vulnerability resides in the Windows cdd component and requires prior code execution at a low-privileged level.
Read more → -
ZDI-26-179: Microsoft Windows win32kfull Improper Locking Local Privilege Escalation Vulnerability
This is a local privilege escalation vulnerability in Windows win32kfull requiring prior low-privileged code execution. The ZDI assigned a CVSS rating of 8.8.
Read more → -
ZDI-26-180: Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability
The vulnerability resides in the Windows cdd component and requires prior code execution at a low-privileged level to trigger improper locking conditions.
Read more → -
ZDI-26-181: Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability
This vulnerability allows local privilege escalation in Microsoft Windows win32full component. Exploitation requires an attacker to already have code execution on the target system.
Read more → -
ZDI-26-182: Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability
This vulnerability requires prior local code execution to exploit. The advisory assigns a CVSS score of 7.8.
Read more → -
ZDI-26-183: Microsoft Windows win32full Improper Release Local Privilege Escalation Vulnerability
This is a local privilege escalation vulnerability in Microsoft Windows win32full. Exploitation requires prior execution of low-privileged code on the target system.
Read more → -
ZDI-26-184: Microsoft Windows NDIS Driver Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability requires local access for exploitation and targets the Windows NDIS driver.
Read more → -
ZDI-26-185: Microsoft Windows GDI Bitmap Parsing Out-Of-Bound Read Information Disclosure Vulnerability
This is an information disclosure vulnerability in Windows GDI bitmap parsing. Attack requires interaction with GDI library but specific attack vectors are not detailed.
Read more → -
ZDI-26-186: Fortinet FortiClient Link Following Local Privilege Escalation Vulnerability
The vulnerability involves link following in FortiClient that can lead to local privilege escalation when low-privileged code execution is already achieved.
Read more → -
ZDI-26-171: Unraid Update Request Path Traversal Remote Code Execution Vulnerability
The vulnerability requires authentication and involves a path traversal in the update request functionality of Unraid, potentially leading to remote code execution.
Read more → -
ZDI-26-172: Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability
The advisory notes that authentication can be bypassed via a path traversal in the authentication request, with no authentication required to exploit.
Read more → -
ZDI-26-151: Delta Electronics CNCSoft-G2 DPAX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability involves an out-of-bounds write in CNCSoft-G2 during DPAX file parsing, requiring user interaction for exploitation.
Read more → -
ZDI-26-152: Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
The vulnerability requires prior local code execution to escalate privileges. The advisory notes a CVSS score of 7.8 for this local privilege escalation.
Read more → -
ZDI-26-153: (Pwn2Own) Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability requires user interaction during the device pairing process to trigger the heap-based buffer overflow in the Zigbee stack.
Read more → -
ZDI-26-154: (Pwn2Own) Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is a heap-based buffer overflow in the Philips Hue Bridge's HomeKit Pair-Setup process, exploitable without authentication.
Read more → -
ZDI-26-155: (Pwn2Own) Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability involves a heap-based buffer overflow in the hap_pair_verify_handler due to sub-TLV parsing on the Philips Hue Bridge.
Read more → -
ZDI-26-156: (Pwn2Own) Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on Philips Hue Bridge installations without requiring credentials.
Read more → -
ZDI-26-157: (Pwn2Own) Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability
The advisory notes a static nonce in the HomeKit Accessory Protocol can enable authentication bypass on Philips Hue Bridge.
Read more → -
ZDI-26-158: (Pwn2Own) Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is a heap-based buffer overflow in the hk_hap_pair_storage_put function, exploitable remotely without authentication.
Read more → -
ZDI-26-159: (Pwn2Own) Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability
Authentication is required to exploit the vulnerability, but the advisory notes the authentication mechanism can be bypassed.
Read more → -
ZDI-26-160: (Pwn2Own) Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability
The vulnerability affects Philips Hue Bridge and enables arbitrary code execution without authentication.
Read more → -
ZDI-26-161: GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability is an out-of-bounds write in GStreamer's DVB subtitle parser, requiring interaction with the library but allowing arbitrary code execution.
Read more → -
ZDI-26-162: GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability
A stack-based buffer overflow exists in the GStreamer H.266 codec parser, which could allow remote code execution if exploited during media processing.
Read more → -
ZDI-26-163: GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is a heap-based buffer overflow in the GStreamer JPEG parser that may allow remote code execution.
Read more → -
ZDI-26-164: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is a heap-based buffer overflow in the GStreamer ASF demuxer that may allow remote code execution.
Read more → -
ZDI-26-165: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability
GStreamer RealMedia demuxer contains an out-of-bounds write vulnerability that may lead to remote code execution. Attack vectors depend on how applications implement the library.
Read more → -
ZDI-26-166: GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability affects GStreamer's rtpqdm2depay component, allowing remote code execution via an out-of-bounds write. Attack vectors depend on how the library is implemented.
Read more → -
ZDI-26-167: GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
The vulnerability is a heap-based buffer overflow in the GStreamer rtpqdm2depay element, which can lead to remote code execution.
Read more → -
ZDI-26-168: GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability
The vulnerability requires interaction with GStreamer library to trigger. Attack vectors vary based on implementation.
Read more → -
ZDI-26-169: GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability
GStreamer H.266 parser contains an integer underflow vulnerability. The ZDI has assigned a CVSS rating of 7.8 for this remote code execution issue.
Read more → -
ZDI-26-170: GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability
The vulnerability is an out-of-bounds write in the GStreamer H.266 codec parser that could allow remote code execution.
Read more →
Page 7 of 8 · 755 advisories