CVE-2026-13466
Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers. This issue affects Trusted Fi
CVSS
8.1
High
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: Sep 24, 2026 · Last modified: Sep 24, 2026 · CWE-131
0.1%EPSS · 30 days0.1%
2026-09-252026-10-19
Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-95111——
———A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes.
The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied.
A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.4hCVE-2026-1120086.1 MED3.2%
——1libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.1dCVE-2026-921566.5 MED44.3%
——13F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.5dCVE-2026-865637.8 HIG4.9%
——1A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.6dCVE-2026-1020277.5 HIG38.5%
——12An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.4dCVE-2026-1065745.3 MED9.5%
——3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31.12d