CVE-2026-112021
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers
CVSS
7.5
High
EPSS
0.7%
p51
KEV
—
Exploit Today
15
0-100
Published: Oct 18, 2026 · Last modified: Oct 19, 2026 · CWE-122
0.7%EPSS · 30 days0.7%
2026-10-192026-10-20
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
- codeberg.orghttps://codeberg.org/grunfink/snac2
- codeberg.orghttps://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7
- codeberg.orghttps://codeberg.org/grunfink/snac2/releases/tag/2.93
- codeberg.orghttps://codeberg.org/grunfink/snac2/src/tag/2.92/xs_json.h#L283-L285
- gist.github.comhttps://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b
- nullenvk.plhttps://nullenvk.pl/posts/02-snac2-json
- www.vulncheck.comhttps://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-114112——
——0Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.17hCVE-2026-1140458.8 HIG—
——0FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.17hCVE-2026-101369.1 CRI—
——0A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.21hCVE-2025-714367.1 HIG—
——0Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.22hCVE-2026-43855—47.0%
——14A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.22hCVE-2026-112403—23.7%
——7Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.22h