CVE-2026-112373
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist
CVSS
6.5
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 20 oct 2026 · Última mod.: 20 oct 2026 · CWE-119 · CWE-121
Sin historial EPSS suficiente todavía.
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-17518——
——0Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.10hCVE-2026-1122577.8 ALT—
——0A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.14hCVE-2026-105810——
——0Tapo C320WS
V2.0 contains an authenticated stack-based buffer overflow in the local
onboarding Wi-Fi configuration path. An authenticated attacker on the
adjacent network can submit a crafted request containing an oversized encrypted
password field, overwrite stack state, and execute commands with root
privileges.
Successful
exploitation may allow an authenticated adjacent-network attacker to take
control of the affected camera, modify camera behavior, access sensitive local
configuration, and disrupt device availability.15hCVE-2025-556675.5 MED—
——0A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.15hCVE-2026-126658.1 ALT—
——0IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.8hCVE-2026-1122816.1 MED—
——0libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.15h