CVE-2026-65787
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS
7.8
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 11 ago 2026 · Última mod.: 12 ago 2026 · CWE-122 · CWE-125
Sin historial EPSS suficiente todavía.
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-174858.2 ALT—
———IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.3hCVE-2026-196547.5 ALT—
———A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.4hCVE-2026-190048.1 ALT—
———An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.4hCVE-2026-734346.1 MED—
———A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).3hCVE-2026-196435.3 MED—
———An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.
To remediate this issue, users should upgrade to version 1.11.862.5hCVE-2026-168637.7 ALT—
———IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.4h