CVE-2026-64558
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitl
CVSS
7.8
High
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Jul 29, 2026 · Last modified: Oct 19, 2026 · CWE-122
0.1%EPSS · 30 days0.1%
2026-10-052026-11-02
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer.
- git.kernel.orghttps://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc
- git.kernel.orghttps://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4
- git.kernel.orghttps://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da
- git.kernel.orghttps://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1204317.8 HIG—
——0Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.21hCVE-2026-1202087.5 HIG30.3%
——9libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.22hCVE-2026-102212—25.0%
——7Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.21hCVE-2026-1197276.5 MED16.7%
——5A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.6hCVE-2026-1101335.8 MED14.4%
——4A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.4dCVE-2026-95367.5 HIG23.6%
——7A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.4d