CVE-2026-58088
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterate
CVSS
7.4
Alto
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 19 ago 2026 · Última mod.: 27 oct 2026 · CWE-362 · CWE-787
0.1%EPSS · 30 días0.1%
2026-10-042026-10-31
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer. An unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-784027.8 ALT3.9%
——1Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow
Buffers.
Sentinel Keys Server does not check the length of the first field in
the input message. A local attacker may craft an input and send it to Sentinel
Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling
local privilege escalation.
This issue affects Sentinel Keys Server: versions
lower than 1.3.8.0.2dCVE-2026-618548.2 ALT15.6%
——5VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.2dCVE-2026-1197777.8 ALT8.2%
——2A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.2dCVE-2026-1040677.8 ALT9.4%
——3Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.2dCVE-2026-1040667.8 ALT11.5%
——3Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.2dCVE-2026-1040657.8 ALT9.4%
——3Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.2d