CVE WatchSep 10, 2026

CVE-2026-53002

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf,

CVSS

9.8

Critical

EPSS

0.4%

p31

KEV

—

Exploit Today

0-100

Published: Jun 24, 2026 · Last modified: Sep 10, 2026 · CWE-787

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-08-202026-09-18

Technical description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-930156.3 MED

15.9%

——5BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.1d CVE-2026-928806.3 MED

16.4%

——5A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.23h CVE-2026-252807.8 HIG

1.5%

——0Memory corruption when processing escape handling flow with insufficient user buffer sizes.1h CVE-2026-240747.8 HIG

5.8%

——2Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.1h CVE-2026-240737.8 HIG

5.8%

——2Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.1h CVE-2026-927867.8 HIG

2.8%

——1LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.2d