CVE WatchAug 15, 2026

CVE-2023-3867

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consid

CVSS

9.1

Critical

EPSS

6.1%

p93

KEV

—

Exploit Today

0-100

Published: Aug 16, 2025 · Last modified: Aug 15, 2026 · CWE-125

EPSS · 30d

5.4%EPSS · 30 days6.1%

2026-10-052026-11-01

Technical description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup().

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1207402.0 LOW

—

———A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).5h CVE-2026-1200605.9 MED

—

———psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.7h CVE-2026-1204533.3 LOW

—

———The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.8h CVE-2026-1204376.1 MED

—

———Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.8h CVE-2026-111959—

—

———Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.7h CVE-2026-685905.3 MED

—

——0In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152.11h