CVE WatchOct 15, 2026

CVE-2026-109438

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauth

CVSS

5.3

Medium

EPSS

0.4%

p28

KEV

—

Exploit Today

0-100

Published: Oct 14, 2026 · Last modified: Oct 15, 2026 · CWE-908

EPSS · 30d

Not enough EPSS history yet.

Technical description

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-976296.5 MED

6.5%

——2Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.15h CVE-2026-1040865.5 MED

7.8%

——27-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.2d CVE-2026-970118.8 HIG

53.0%

——16Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.11h CVE-2026-968505.5 MED

32.2%

——10Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.3d CVE-2026-968495.5 MED

32.2%

——10Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.3d CVE-2026-962475.5 MED

32.2%

——10Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.3d