CVE-2022-35737
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a
CVSS
7.5
Alto
EPSS
23.6%
p98
KEV
—
Exploit Today
29
0-100
Publicado: 3 ago 2022 · Última mod.: 14 oct 2026 · CWE-129
21.5%EPSS · 30 días23.6%
2026-09-242026-10-23
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
- blog.trailofbits.comhttps://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- kb.cert.orghttps://kb.cert.org/vuls/id/720344
- security.gentoo.orghttps://security.gentoo.org/glsa/202210-40
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20220915-0009/
- sqlite.orghttps://sqlite.org/releaselog/3_39_2.html
- www.sqlite.orghttps://www.sqlite.org/cves.html
- blog.trailofbits.comhttps://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- kb.cert.orghttps://kb.cert.org/vuls/id/720344
- security.gentoo.orghttps://security.gentoo.org/glsa/202210-40
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20220915-0009/
- sqlite.orghttps://sqlite.org/releaselog/3_39_2.html
- www.sqlite.orghttps://www.sqlite.org/cves.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1157226.1 MED—
———RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.8hCVE-2026-89319—10.3%
——3`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.11hCVE-2026-114405—26.7%
——8Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.1dCVE-2026-1036727.1 ALT2.1%
——1The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.3dCVE-2026-92449—4.6%
——1`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.3dCVE-2026-487417.5 ALT36.4%
——11libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.3d