CVE-2022-32386
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.
CVSS
9.8
Critical
EPSS
10.2%
p96
KEV
—
Exploit Today
29
0-100
Published: Jul 6, 2022 · Last modified: Jul 9, 2026 · CWE-787
10.2%EPSS · 30 days10.2%
2026-10-102026-11-08
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.
- drive.google.comhttps://drive.google.com/file/d/1XPTEt10yJt9WcLrIt6YpDV5OlP-U6dBR/view?usp=sharing
- github.comhttps://github.com/LuGakki/Vuln/blob/main/Tenda%20AC23.pdf
- drive.google.comhttps://drive.google.com/file/d/1XPTEt10yJt9WcLrIt6YpDV5OlP-U6dBR/view?usp=sharing
- github.comhttps://github.com/LuGakki/Vuln/blob/main/Tenda%20AC23.pdf
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1165018.4 HIG—
——0IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.5hCVE-2026-1236157.5 HIG45.2%
——14imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.20hCVE-2026-104267—1.4%
——0Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0.2dCVE-2026-1239765.5 MED1.9%
——1EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 annotation signals to overwrite edfhdrblock members, including the signal parameter pointer, crashing the application when opened.2dCVE-2026-1123344.9 MED47.0%
——14Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.2dCVE-2026-891426.3 MED13.3%
——4In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.2d