CVE-2026-101310
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry c
CVSS
7.0
Alta
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 15 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-126 · CWE-362 · CWE-787
0.1%EPSS · 30 dias0.2%
2026-10-152026-11-06
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-173377.4 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.5hCVE-2026-104267——
———Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0.12hCVE-2026-1239765.5 MÉD—
——0EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 annotation signals to overwrite edfhdrblock members, including the signal parameter pointer, crashing the application when opened.16hCVE-2026-1123344.9 MÉD—
——0Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.14hCVE-2026-891426.3 MÉD13.3%
——4In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.21hCVE-2026-926945.9 MÉD16.0%
——5FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review.1d