CVE-2026-120457
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-196
Not enough EPSS history yet.
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.
- github.comhttps://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586
- github.comhttps://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64
- github.comhttps://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66
- github.comhttps://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7
- hackmd.iohttps://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder
- hackmd.iohttps://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1065675.9 MED36.3%
——11ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.25dCVE-2026-930199.1 CRI51.3%
——15Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.45dCVE-2026-583176.3 MED25.1%
——8Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.9dCVE-2026-144549.8 CRI51.4%
——15Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.
Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.
An attacker could craft an image with EXIF data that terminates a worker process.8dCVE-2026-341555.3 MED3.9%
——1RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a legitimate signature, an attacker can modify the part of the payload which is not covered by the signature. This issue has been patched in version 1.15.2.101d