CVE-2026-125393
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated u
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-122
Not enough EPSS history yet.
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer. Attackers can supply an X-FB-USER address longer than about 1016 bytes, which is formatted without a length check, to crash the IMAP service and cause denial of service.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-917607.0 HIG—
———Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux.
This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.7hCVE-2026-8912610.0 CRI—
———SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.11hCVE-2026-1254018.1 HIG—
———Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.12hCVE-2026-1252607.0 HIG—
——0FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application.16hCVE-2026-1252507.8 HIG—
——0FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding.17hCVE-2026-1252357.0 HIG—
——0FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel Quick Sync encoders without rescaling, to crash the application or corrupt heap memory.17h