PULSEUnderground Intel

EN VIVO90señales / 24h

FEED

ransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerceransomeclipse reclama a La'ala Al Kuwait Real Estate Co KSCC · KW · Retail & E-Commerceransomrhysida reclama a M.C.S. Steel Public Company Limited · TH · Manufacturingransomhyflock reclama a Cameroon government troops leaked · CM · Government & Defenseransombyod reclama a Texas HHSC · US · Government & Defenseransombyod reclama a Vanderbilt EDU · US · Educationransomeverstake reclama a carrollins.com · US · Retail & E-Commerceransomaurora reclama a Johnson Development Corp. · Otherransomn0n reclama a Company #211 · USransomn0n reclama a Company #210 · USransomn0n reclama a Company #209 · USransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerceransomeclipse reclama a La'ala Al Kuwait Real Estate Co KSCC · KW · Retail & E-Commerceransomrhysida reclama a M.C.S. Steel Public Company Limited · TH · Manufacturingransomhyflock reclama a Cameroon government troops leaked · CM · Government & Defenseransombyod reclama a Texas HHSC · US · Government & Defenseransombyod reclama a Vanderbilt EDU · US · Educationransomeverstake reclama a carrollins.com · US · Retail & E-Commerceransomaurora reclama a Johnson Development Corp. · Otherransomn0n reclama a Company #211 · USransomn0n reclama a Company #210 · USransomn0n reclama a Company #209 · US

← Todos los CVEs

CVE Watch9 nov 2026

CVE-2026-49423

When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in th

CVSS

3.3

Bajo

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Publicado: 19 ago 2026 · Última mod.: 9 nov 2026 · CWE-908

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-10-122026-11-09

Descripción técnica

When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was allocated without zeroing. A remote TLS peer can cause the kernel to read from uninitialized iovec entries during HMAC computation, resulting in a kernel panic. The peer must be able to control TCP segmentation such that the first mbuf of a CBC record contains only the 5-byte TLS record header.

Referencias oficiales

security.freebsd.orghttps://security.freebsd.org/advisories/FreeBSD-SA-26:46.ktls.asc

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1252683.3 BAJ

——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.4h CVE-2026-1252663.3 BAJ

——0FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.4h CVE-2026-1252433.3 BAJ

——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.5h CVE-2026-1252173.3 BAJ

——0FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets.5h CVE-2026-1251952.5 BAJ

——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.5h CVE-2026-1251923.3 BAJ

——0FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.5h